MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains multiple embedded URLs, with one identified as a malicious redirector. The document body, though heavily obfuscated, contains the same malicious URL and a reference to a Shopify-hosted PDF, suggesting a link farm or SEO poisoning attempt. The primary malicious URL is https://ttraff.ru/wix?keyword=mutlu+ol+iyi+bak+kendine+gitar+akoru, which is likely used to redirect users to a malicious site. No scripts were extracted from this sample.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/wix?keyword=mutlu+ol+iyi+bak+kendine+gitar+akoru
- https://cdn.shopify.com/s/files/1/0432/2384/2978/files/xivexepidirevon.pdf
- https://cdn.shopify.com/s/files/1/0437/6176/2455/files/30946578030.pdf
- https://cdn.shopify.com/s/files/1/0427/7754/2823/files/dizefisej.pdf
- https://cdn.shopify.com/s/files/1/0437/4636/1505/files/android_browser_full_screen_video.pdf
- https://cdn.shopify.com/s/files/1/0437/0235/4070/files/mibimidurinugexotax.pdf
- https://static.usrfiles.com/ugd/b8c837_5cb81d1e40c9449fbe1879366c177ecd.pdf
- https://static.usrfiles.com/ugd/b8c837_fb9a9745171f4fb78018aa215484b74f.pdf
- https://static.usrfiles.com/ugd/b8c837_b3a4049a418247858f55f6e62fffce9a.pdf
- https://static.usrfiles.com/ugd/cbe7f7_81adcf548aca460f96ba6ec6c7696a0d.pdf
- https://static.usrfiles.com/ugd/b8c837_4a55b82ce3a84c6fac59833af00e8dda.pdf
- https://static.usrfiles.com/ugd/b8c837_4f8343cff1d749209f13e85b872057f1.pdf
- https://static.usrfiles.com/ugd/b8c837_00f12b5f256a46199567452546e0d61c.pdf
- https://static.usrfiles.com/ugd/01e791_cf01df280e3d4362b874a3b156da9582.pdf
- https://static.usrfiles.com/ugd/b8c837_d345e268873f4e8cafee38c42d1886bc.pdf
- https://static.usrfiles.com/ugd/b8c837_55b2050e17af4d6ca8bd236f28beb499.pdf
- https://static.usrfiles.com/ugd/b8c837_cbda78b3ee63433cb05b7472cff4917e.pdf
- https://static.usrfiles.com/ugd/b65acf_d8e982d300994303bda7ade690b43b8f.pdf
- https://static.usrfiles.com/ugd/97634b_1073d1a58f5247c7a4ced198fb46b8e6.pdf
- https://static.usrfiles.com/ugd/7ef0dc_061483e34bbb4545b95748aa5b86010e.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://static.usrfiles.com/ugd/b8c837_d345e268873f4e8cafee
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006480.bind72fd54b9b9c9f4fb24691ec8a46848d0f84d7fb287e40920470005841ac81db |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6480 | 5008 bytes |
font_01_sfnt_off0000759f.bine86f2fe52fd065a7f4ff491ea4b54d3469778881eedb66bc567cc785522855d1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x759F | 15964 bytes |
font_02_sfnt_off0000a4ac.binff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA4AC | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.