MALICIOUS
128
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a lure related to 'Tales of a harem in another world' and includes an embedded URL that redirects to a malicious domain (ttraff.me). The document body, though partially corrupted, contains the same malicious URL. The PDF also exhibits characteristics of a link farm, with numerous links pointing to external PDFs, many hosted on cdn.shopify.com, suggesting an attempt to distribute content or mask malicious links. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' directly flags the ttraff.me URL as malicious.
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Urgency / deadline lure low SE_URGENCY_LUREDocument contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/pify?keyword=tales+of+a+harem+in+another+world
- http://files.thechildrenspiazza.com/uploads/1/3/1/4/131406885/seronekoxa.pdf
- http://xulup.1corinthiens15.com/uploads/1/3/0/8/130874113/lokuzanosafajovowok.pdf
- http://nulomaduw.raffaelecassina.com/uploads/1/3/0/8/130813965/sufozuzofo-tilepasokivej-vijunogawisosa-ginesoxujavuw.pdf
- http://files.onthemark2k.com/uploads/1/3/1/6/131637136/38810f8b8db10b.pdf
- https://cdn.shopify.com/s/files/1/0428/2338/5247/files/37224186663.pdf
- https://cdn.shopify.com/s/files/1/0431/2216/3876/files/26885507010.pdf
- https://cdn.shopify.com/s/files/1/0434/0645/9029/files/jelivi.pdf
- https://cdn.shopify.com/s/files/1/0432/2331/8686/files/pomofare.pdf
- https://cdn.shopify.com/s/files/1/0434/6036/2392/files/joint_of_two_uniform_random_variables.pdf
- https://cdn.shopify.com/s/files/1/0440/5103/8358/files/56561228858.pdf
- https://cdn.shopify.com/s/files/1/0429/5373/6351/files/kobuxovemivodigizinexi.pdf
- https://cdn.shopify.com/s/files/1/0440/7777/7061/files/razezepikofojixavan.pdf
- https://cdn.shopify.com/s/files/1/0437/1031/6694/files/arthashastra_in_telugu.pdf
- https://cdn.shopify.com/s/files/1/0431/9451/5614/files/72401630010.pdf
- https://cdn.shopify.com/s/files/1/0447/1973/4938/files/windows_10_mouse_acceleration.pdf
- https://cdn.shopify.com/s/files/1/0430/8366/1461/files/86741231680.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000070fa.bin423e4fce76839462eb6fb946f9f9a2b0beeb3b01daf22a6811eb12a2cb545ef3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x70FA | 5188 bytes |
font_01_sfnt_off00008283.binf7f74cd7067ee9e7e1e410bb3ae849abfed38f2fcb40406311750595b5d91872 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8283 | 10216 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.