MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file was flagged by multiple critical heuristics for containing a malicious redirector link and a large link farm. The embedded URL 'https://ttraff.link/wix?keyword=5e+water+genasi+names' is identified as a malicious redirector. The document body, though heavily obfuscated, also contains this URL and numerous other PDF links, suggesting a coordinated effort to distribute malicious content through a link farm. The ML classifier also strongly indicated maliciousness.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.link/wix?keyword=5e+water+genasi+names
- http://wowufodes.healingnotesllc.com/uploads/1/3/1/4/131408172/90779.pdf
- http://files.magnificentheavens.com/uploads/1/3/0/9/130969265/rakemar.pdf
- http://files.jmplaser.com/uploads/1/3/0/9/130969489/3541420.pdf
- https://42c45dc6-f9ef-4886-b51b-e0f17296c2d0.filesusr.com/ugd/dc6899_0111a42170eb4c219669d37628e2fc27.pdf?index=true
- https://4ffb9bb3-1194-46b1-8912-e07bb8e9a44a.filesusr.com/ugd/229b11_8c2cf5596f0d4428b12ea982a2b9ebc5.pdf?index=true
- https://d394c4d4-aeea-4299-bf5c-65aa823ca4de.filesusr.com/ugd/135178_edf491b056df4a9690346d2222ce88ef.pdf?index=true
- https://5a5ff6ac-bc70-4f48-b734-c39ec7bb1b7d.filesusr.com/ugd/5a4aad_a865b3e1390443658bbb418265b1621d.pdf?index=true
- https://e2bdb461-3c94-433d-8b4a-59879a91bbd1.filesusr.com/ugd/bdc04d_0aa58c0945a341c7b8bd4788e1e66517.pdf?index=true
- https://ee87493f-4587-4948-80d9-06c8183028da.filesusr.com/ugd/8e66a5_3175097a0ac8472b8cf672bad9269d82.pdf?index=true
- https://ee850b6c-8737-4163-b4c5-24929de39e0b.filesusr.com/ugd/162fe6_0290de4c942e4fb4b4da67d6d79f0155.pdf?index=true
- https://fe522fbe-15a9-4c40-8947-7679140b94e7.filesusr.com/ugd/135178_d14882f57bb44fcdb315c7cc40afdb38.pdf?index=true
- https://5ded3e8b-d2a2-403b-855d-dcf9c725d984.filesusr.com/ugd/65b209_228d8e745bf242bbb946500795959254.pdf?index=true
- https://cdn.shopify.com/s/files/1/0446/3457/0915/files/agenesia_de_corpo_caloso.pdf
- https://cdn.shopify.com/s/files/1/0440/2610/1910/files/ruvitekalokatajumoxadu.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000695d.bin7473d28e4fc9236bd48d0929bacbc2a288a51dd216ae30e6d969bf622d71460b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x695D | 5096 bytes |
font_01_sfnt_off00007aaf.bin71ed135992230c105549c900583aaf6b7ac485c6951f9812cf6d38f474ecd229 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7AAF | 9948 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.