MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a lure related to 'Marks and Spencer mens shoe size guide' and embeds a link that redirects to a known malicious domain. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK confirms this redirection. Additionally, the PDF contains a link farm with numerous external PDF links, as indicated by the PDF_SEO_LINK_FARM heuristic, suggesting a broader campaign to distribute malicious content or engage in SEO manipulation for malicious purposes. The embedded URL is the primary indicator of malicious intent, likely leading to a phishing or malware download site.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/wix?keyword=marks+and+spencer+mens+shoe+size+guide
- https://static.usrfiles.com/ugd/6c98bc_33d8bf7854e74755904dbe3a11e4a4bd.pdf
- https://static.usrfiles.com/ugd/77eba6_b07292059d30410988083fbdb074c0e2.pdf
- https://static.usrfiles.com/ugd/b8bbd7_a8c88d5c21c84cd4aaa32048d667acad.pdf
- https://static.usrfiles.com/ugd/ad2ade_14f7faf505ec456e97b0df4efa918326.pdf
- https://cdn.shopify.com/s/files/1/0437/7578/7157/files/calligraphy_for_beginners_worksheets.pdf
- https://cdn.shopify.com/s/files/1/0430/7622/3129/files/nirinewajibel.pdf
- https://cdn.shopify.com/s/files/1/0428/9367/2604/files/kunci_jawaban_buku_akuntansi_biaya_mulyadi_edisi_5.pdf
- https://cdn.shopify.com/s/files/1/0440/9019/6133/files/how_to_communicate_effectively_in_the_workplace.pdf
- https://cdn.shopify.com/s/files/1/0429/6137/1290/files/47233493782.pdf
- https://cdn.shopify.com/s/files/1/0435/3789/1477/files/loctite_770_msds.pdf
- https://cdn.shopify.com/s/files/1/0431/8851/9080/files/lebozosenobip.pdf
- https://cdn.shopify.com/s/files/1/0439/4817/9611/files/dupikabum.pdf
- https://cdn.shopify.com/s/files/1/0465/4576/4510/files/emma_king_eczema_clinic.pdf
- https://cdn.shopify.com/s/files/1/0434/7219/1641/files/34399966559.pdf
- https://static.usrfiles.com/ugd/963627_7680b9fdf8634123aa3c533c468037d6.pdf
- https://static.usrfiles.com/ugd/3aee12_c84b83804f1a40d7a861a6649398192a.pdf
- https://static.usrfiles.com/ugd/32777b_0ba803b07a1b4b639431c3024df3c7e7.pdf
- https://static.usrfiles.com/ugd/bf0735_1078b63af4de406c8dc204b2931ca5e5.pdf
- https://static.usrfiles.com/ugd/c0b427_5a961e487f3f42018f6b262357a876dd.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00005fe2.bin75e2cbe2552ac7de5d7c25d64e9abbc1636d4213c20566145dbe0c57743e3e66 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5FE2 | 5572 bytes |
font_01_sfnt_off000072c7.bin9d0e36d0aded8d3f8483a98fd2a1ed61fe38ccdae43075094980881e74354f1e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x72C7 | 13820 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.