MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a heuristic firing for a malicious redirector link, which is also present in the document body. This link, 'https://ttraff.com/wix?keyword=skills+worksheet+directed+reading+section+continental+drift+answer+key', is designed to lure users with a seemingly relevant search query. The document also contains a PDF link farm heuristic, indicating a large number of outbound links, with the primary one being 'https://static.usrfiles.com/ugd/72b0e7_af8b8fc647d94625958f01138b5f9de1.pdf'. The combination of these factors suggests a phishing or social engineering attack.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/wix?keyword=skills+worksheet+directed+reading+section+continental+drift+answer+key
- https://static.usrfiles.com/ugd/72b0e7_af8b8fc647d94625958f01138b5f9de1.pdf
- https://static.usrfiles.com/ugd/19ce5d_be8f6d2ccef54ad89f7f163bc7bed377.pdf
- https://static.usrfiles.com/ugd/08fe48_8160876266d64d3ab24e7f6ddebc9c2e.pdf
- https://static.usrfiles.com/ugd/dfb5f8_a8b3e37af4004b3ca2413813fd07bd6d.pdf
- https://static.usrfiles.com/ugd/0d002d_788778b453c44c90928dfe158bea9501.pdf
- https://static.usrfiles.com/ugd/b8c837_620011206012453e89e1da7d9a111f2b.pdf
- https://static.usrfiles.com/ugd/b8c837_d1b8ade76229454ea10986fb5444fb58.pdf
- https://static.usrfiles.com/ugd/2f8cea_713728eca9c34989baddeeba0e08144b.pdf
- https://static.usrfiles.com/ugd/b8c837_d16976069f194bbc8d388cb05b025464.pdf
- https://static.usrfiles.com/ugd/b8c837_336d3089a682468f804f0b8855b4b0a6.pdf
- https://static.usrfiles.com/ugd/affb4a_a1535b021dfc490189cfdcb566ddb2fb.pdf
- https://static.usrfiles.com/ugd/de60da_21d61e63b5c54498811db3db8bfdcbbc.pdf
- https://static.usrfiles.com/ugd/0df15e_ab39b8caa9cb4f35b251f3f387a38f11.pdf
- https://static.usrfiles.com/ugd/79e5df_bfad8d6e3a514c609f3e6d9f823c812e.pdf
- https://static.usrfiles.com/ugd/b8c837_d92ad30fac2644a2bd6569eb96969c32.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001330d.binb6adba076546873fd15fcc2bb9a47e9e2f12b82044cb2d3858cf68285b829de6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1330D | 5644 bytes |
font_01_sfnt_off00014643.bin117667abb55354f9a97f540e89e1cab80f1fe41da2f224d1d5709721a5eca743 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14643 | 14984 bytes |
font_02_sfnt_off00017478.bin9b0eba6d343478e30294a238d2572fdd523a553325d76887af1e455443ae3910 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x17478 | 16200 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.