MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK, indicating it points to malicious infrastructure. Additionally, PDF_SEO_LINK_FARM indicates a large number of external links, likely for SEO manipulation or to obscure the malicious redirector. The embedded URL 'https://ttraff.com/pify?keyword=information+value+greater+than+1' is the primary indicator of malicious intent, likely serving as a redirector to a phishing or malware distribution site. The document body contains garbled text but includes the malicious URL and several benign-looking Shopify URLs.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/pify?keyword=information+value+greater+than+1
- http://files.angeldreamsquiltshop.com/uploads/1/3/0/7/130776072/2330622.pdf
- http://files.stjohnlutheranchurch.com/uploads/1/3/1/4/131454034/9002567.pdf
- http://vofon.truckersunitedforfreedom.com/uploads/1/3/0/7/130776031/xegikirupufaru_gudajep.pdf
- https://cdn.shopify.com/s/files/1/0437/3810/3962/files/water_and_waste_management_system.pdf
- https://cdn.shopify.com/s/files/1/0427/7446/2631/files/69124825709.pdf
- https://cdn.shopify.com/s/files/1/0429/8709/4179/files/android_floating_button_add_icon.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/80278007767.pdf
- https://cdn.shopify.com/s/files/1/0433/0291/2158/files/74231115115.pdf
- https://cdn.shopify.com/s/files/1/0431/0774/5958/files/neet_books_download_free.pdf
- https://cdn.shopify.com/s/files/1/0434/8156/3286/files/a_thousand_years_sheet_music_piano_guys.pdf
- https://cdn.shopify.com/s/files/1/0431/6502/4412/files/baltic_sea_map.pdf
- https://cdn.shopify.com/s/files/1/0430/1645/4305/files/56632279641.pdf
- https://cdn.shopify.com/s/files/1/0435/5745/3985/files/ashlar_masonry.pdf
- https://cdn.shopify.com/s/files/1/0438/3988/1373/files/23768865016.pdf
- https://cdn.shopify.com/s/files/1/0432/2033/6807/files/54367126445.pdf
- https://cdn.shopify.com/s/files/1/0432/4642/0132/files/3630933776.pdf
- https://cdn.shopify.com/s/files/1/0434/0501/7253/files/99958370929.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006628.bin013890533165128cacbb7f77a45a751fe1b4e7cf4c517b379193861245c228a8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6628 | 5052 bytes |
font_01_sfnt_off00007733.bin59b5f2a33af09491cb59b8a0396bef82dafe7085cd624e4dd4b989cce3358782 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7733 | 10780 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.