MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.ru/wix?keyword=ultrasound+guided+iud+insertion+cpt'. This indicates the document's primary purpose is to redirect users to a malicious site. The presence of a PDF link farm heuristic further supports the malicious intent by suggesting an attempt to manipulate search engine results or distribute malicious content. No scripts were extracted from this sample.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/wix?keyword=ultrasound+guided+iud+insertion+cpt
- https://static.usrfiles.com/ugd/83d902_3df5475332fe462d9dacc1f3aab8fd87.pdf
- https://static.usrfiles.com/ugd/43d598_2857191ffa9c4c1da369b68320575a8c.pdf
- https://static.usrfiles.com/ugd/70c1f8_e835971b4d244105b47ee417396ff552.pdf
- https://static.usrfiles.com/ugd/d54300_155c4ab7e3a64c4fb31d30072db8be98.pdf
- https://static.usrfiles.com/ugd/b8c837_c18c34ad10884e728dd5f90b0d3ff43b.pdf
- https://cdn.shopify.com/s/files/1/0435/3697/3975/files/84141109782.pdf
- https://cdn.shopify.com/s/files/1/0433/9728/3996/files/70339671371.pdf
- https://cdn.shopify.com/s/files/1/0431/6197/6994/files/24374591997.pdf
- https://cdn.shopify.com/s/files/1/0431/6528/6566/files/assassin_creed_1_free_pc_game.pdf
- https://cdn.shopify.com/s/files/1/0430/3152/7575/files/the_testaments_atwood.pdf
- https://cdn.shopify.com/s/files/1/0434/1606/0061/files/nuwidojetozikewinopijaxik.pdf
- https://cdn.shopify.com/s/files/1/0433/3348/4699/files/case_in_affitto_a_bressa_di_campoformido.pdf
- https://cdn.shopify.com/s/files/1/0428/6906/3836/files/70561288557.pdf
- https://cdn.shopify.com/s/files/1/0433/7536/2198/files/fight_club_imdb_parents_guide.pdf
- https://cdn.shopify.com/s/files/1/0450/9886/0707/files/voxonigerebu.pdf
- https://cdn.shopify.com/s/files/1/0434/1334/0312/files/nibuxunezikadidabuzipav.pdf
- https://cdn.shopify.com/s/files/1/0432/3858/8584/files/96893811797.pdf
- https://cdn.shopify.com/s/files/1/0441/1988/3928/files/movimientos_obreros_de_cananea_y_rio_blanco.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00007499.bin7475df150af39b2659119076acd852c22b38433f4342595c7e3ee3fad037f988 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7499 | 5232 bytes |
font_01_sfnt_off00008679.binf7c84c47e52e1953cd6b7c914ee5e7ac2c9af2e18602401bbae408a7850d227d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8679 | 10484 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.