MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'ttraff.cc'. The document body, though heavily obfuscated, also contains this URL and numerous other links to Shopify-hosted PDFs, suggesting a link farm or SEO poisoning tactic. The primary intent appears to be redirecting users to malicious infrastructure via the 'ttraff.cc' URL, likely for further exploitation or phishing.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.cc/wb?keyword=making%20sense%20of%20international%20relations%20theory%20pdf
- http://files.wosherbalhealth.com/uploads/1/3/2/7/132740949/bowojegeze.pdf
- http://files.ntangi.com/uploads/1/3/1/4/131406592/1858532.pdf
- http://nodawamot.makerystudios.com/uploads/1/3/0/7/130740596/7969921.pdf
- http://files.alissandratstoyan.com/uploads/1/3/1/4/131437619/pusidevakunetis.pdf
- https://cdn.shopify.com/s/files/1/0435/2085/2122/files/jipavigodikimosozezilaj.pdf
- https://cdn.shopify.com/s/files/1/0428/8266/2553/files/engineering_manager_job_description.pdf
- https://cdn.shopify.com/s/files/1/0428/2161/5775/files/66574895109.pdf
- https://cdn.shopify.com/s/files/1/0440/6879/8614/files/sizojawekinubaso.pdf
- https://cdn.shopify.com/s/files/1/0439/4795/0248/files/tidule.pdf
- https://cdn.shopify.com/s/files/1/0434/4899/1910/files/alteraciones_del_ciclo_menstrual.pdf
- https://cdn.shopify.com/s/files/1/0439/0522/0776/files/fur_elise_classical_guitar_sheet_music.pdf
- https://cdn.shopify.com/s/files/1/0431/4333/2000/files/34433924293.pdf
- https://cdn.shopify.com/s/files/1/0437/1621/4936/files/streamline_english_free_download.pdf
- https://cdn.shopify.com/s/files/1/0428/7148/8668/files/mesaxusovamilawugizi.pdf
- https://cdn.shopify.com/s/files/1/0434/8392/2585/files/starting_out_with_java_7th_edition.pdf
- https://cdn.shopify.com/s/files/1/0431/9199/2481/files/20057890193.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006216.binf1b2cdb62fd8e3803aabbbc932229f76d1c6353924a7790109a9ba3127632b24 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6216 | 5472 bytes |
font_01_sfnt_off000074b9.bina162aa69f6f403864a6a74901edb8792c3b9979cac2ed2c3f678b1b5ab0adaf6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x74B9 | 11460 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.