MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a mass of external links, with one critical heuristic firing indicating a link to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains text related to 'Instagram story covers template' and a URL that aligns with the malicious redirector. The primary intent appears to be directing users to malicious content via the identified redirector.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.cc/wix?keyword=instagram+story+covers+template
- https://static.usrfiles.com/ugd/b8c837_f8c8e72cfd134f259c9e2dc85897efef.pdf
- https://static.usrfiles.com/ugd/ad2ade_d17b6715172f4cf5af17ef04969acc15.pdf
- https://static.usrfiles.com/ugd/b8c837_362ee51d3211409492a2b24e01d55663.pdf
- https://cdn.shopify.com/s/files/1/0434/6822/6725/files/29662144811.pdf
- https://cdn.shopify.com/s/files/1/0461/1457/0404/files/letter_asking_for_donation_template.pdf
- https://cdn.shopify.com/s/files/1/0435/0348/5092/files/wolalovivezorimedovupe.pdf
- https://cdn.shopify.com/s/files/1/0437/1028/3931/files/mebalifuriwizapazub.pdf
- https://cdn.shopify.com/s/files/1/0429/6169/8969/files/kepinerimikoli.pdf
- https://cdn.shopify.com/s/files/1/0436/9013/1609/files/mdicaments_de_l_appareil_respiratoire.pdf
- https://cdn.shopify.com/s/files/1/0434/2883/9581/files/80438318651.pdf
- https://cdn.shopify.com/s/files/1/0433/9128/7450/files/pekafilerixi.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/voriwatovetizejewadodo.pdf
- https://cdn.shopify.com/s/files/1/0429/6795/7660/files/paliniz.pdf
- https://static.usrfiles.com/ugd/be19e1_4ff9c24b7d39405c9d143380b57a85da.pdf
- https://static.usrfiles.com/ugd/45e30f_32e51c63de334da3a4090348a04c79d3.pdf
- https://static.usrfiles.com/ugd/b8c837_e768d5e8f43c4e5a89dd2279a42bb7e2.pdf
- https://static.usrfiles.com/ugd/b8c837_fa69dcda05904dac861d848e4ad6c543.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000077d4.bin27c393fd536f8505962efa3972b1ad22eb8ba6505e3ddae2afd999eb0cf6fa24 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x77D4 | 5352 bytes |
font_01_sfnt_off00008a08.bin13b80463cbc15db39ee0cfee0922df8d903daa05ee1e9036f9877d137cca8072 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8A08 | 10592 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.