MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a critical heuristic firing for a malicious redirector link pointing to 'https://ttraff.com/wix?keyword=meal+planner+grocery+list+template+excel'. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded links, including one to 'https://cdn.shopify.com/s/files/1/0431/5152/4008/files/79964755522.pdf'. The document body, though partially corrupted, suggests a lure related to 'meal planner grocery list template excel' to entice users to click the malicious link. No scripts were extracted, and the family is unknown.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/wix?keyword=meal+planner+grocery+list+template+excel
- https://cdn.shopify.com/s/files/1/0431/5152/4008/files/79964755522.pdf
- https://cdn.shopify.com/s/files/1/0433/1952/5534/files/dopele.pdf
- https://cdn.shopify.com/s/files/1/0463/6003/5483/files/december_2018_calendar_template_editable.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/43778875991.pdf
- https://cdn.shopify.com/s/files/1/0437/7178/9469/files/8452005857.pdf
- https://cdn.shopify.com/s/files/1/0439/3595/7147/files/calendario_laboral_colombia_2018.pdf
- https://cdn.shopify.com/s/files/1/0431/9405/6861/files/11744207951.pdf
- https://cdn.shopify.com/s/files/1/0428/5834/8703/files/44797923776.pdf
- https://cdn.shopify.com/s/files/1/0434/1468/3815/files/archinteriors_31.pdf
- https://static.usrfiles.com/ugd/bfbc46_b4003e78363f4053bffe3e2f80e907c7.pdf
- https://static.usrfiles.com/ugd/289c5e_0edef66a82f944de9419806222d9c47c.pdf
- https://static.usrfiles.com/ugd/2c8d66_dd00347b39ec4c7192b387428bd312d8.pdf
- https://static.usrfiles.com/ugd/b8c837_0f94da350e97404c8c22214bdae5e1c3.pdf
- https://static.usrfiles.com/ugd/0779a3_a9e0a539af3c4f5f9ad28c20b351a085.pdf
- https://static.usrfiles.com/ugd/b8c837_529951ec6117469db58261daf5e5997e.pdf
- https://static.usrfiles.com/ugd/7e0eb0_b80e1bd9fa3b4a0caa6fe2eb26e8b85b.pdf
- https://static.usrfiles.com/ugd/b8c837_28659cd01f1f4b75b434e49e3ee1b8be.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006afe.bin90b89f76be735fa0258fc2fed6b781d246e8f3a9e1ce451ba02dfcee6d157620 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6AFE | 5428 bytes |
font_01_sfnt_off00007d7f.binf69e09044f8c265c78857407ad8c7bce5b8a2160f5cb082bebe9fcdbb77c054b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7D7F | 10572 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.