MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.001 Malicious Link
T1059.001 PowerShell
The PDF contains a mass of external links, many of which are hosted on Shopify and appear to be SEO-optimized PDFs. One prominent link, 'https://ttraff.com/pify?keyword=crazy+frog+song++audio', is identified as a malicious redirector. This suggests the document is part of a link farm or SEO poisoning campaign designed to redirect users to malicious sites. The document body, though heavily obfuscated, also contains the malicious redirector URL and several benign-looking Shopify URLs.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/pify?keyword=crazy+frog+song++audio
- http://moxug.wellspringfertility.com/uploads/1/3/1/3/131380158/besenipexurup-tefamuxozilafut-kipojajinevun.pdf
- http://files.pastorodc.com/uploads/1/3/1/6/131636814/fuduvo-wunim-benejigada.pdf
- http://files.thewanderingbays.com/uploads/1/3/0/8/130814232/pururonesamafuwos.pdf
- http://files.agallisresidence.com/uploads/1/3/0/9/130969003/pipapidod.pdf
- http://files.shrewdtrading.com/uploads/1/3/0/7/130776536/2008919.pdf
- https://cdn.shopify.com/s/files/1/0431/8039/2609/files/essential_biomaterials_science.pdf
- https://cdn.shopify.com/s/files/1/0433/8260/3927/files/dowenup.pdf
- https://cdn.shopify.com/s/files/1/0448/1361/5264/files/allen_test_papers_2020.pdf
- https://cdn.shopify.com/s/files/1/0429/1864/1830/files/39420745596.pdf
- https://cdn.shopify.com/s/files/1/0433/6405/7238/files/xarava.pdf
- https://cdn.shopify.com/s/files/1/0432/2256/5032/files/lajokukabifizu.pdf
- https://cdn.shopify.com/s/files/1/0432/6657/2441/files/2012_chevy_sonic_manual.pdf
- https://cdn.shopify.com/s/files/1/0432/0378/8960/files/nodopogojapes.pdf
- https://cdn.shopify.com/s/files/1/0433/7546/0517/files/lidilub.pdf
- https://cdn.shopify.com/s/files/1/0430/0872/1045/files/votimelipidasatoxaxaze.pdf
- https://cdn.shopify.com/s/files/1/0428/8613/5961/files/92615867812.pdf
- https://cdn.shopify.com/s/files/1/0436/3078/8758/files/bamojadekubuniriwaj.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00007a93.bine35b0a4aeadccabb4ef9d4cf609e673bf3743f95daf39ef086cb7972aa925841 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7A93 | 5100 bytes |
font_01_sfnt_off00008c0b.bin0a2d89a02fd2e2df6e26bc17d1aac7bd6deabdbe9629c5b0ca96f8d4932d00c6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8C0B | 10688 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.