MALICIOUS
130
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a link that redirects to malicious infrastructure, disguised as a guide for 'Dragon age origins mods installation guide'. The PDF also functions as a link farm, with numerous embedded links pointing to various PDF files, many hosted on Shopify. One of these links, 'http://bomovore.lms-art.co.uk/uploads/1/3/1/4/131453574/dopakinefob.pdf', is also flagged as unknown. The presence of a visual download button further supports a malicious intent to trick the user into clicking the link.
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.cc/pify?keyword=dragon+age+origins+mods+installation+guide
- http://bomovore.lms-art.co.uk/uploads/1/3/1/4/131453574/dopakinefob.pdf
- https://cdn.shopify.com/s/files/1/0447/6112/0919/files/pokemon_go_iosemus.pdf
- https://cdn.shopify.com/s/files/1/0429/6815/4278/files/roosa_master_injection_pump.pdf
- https://cdn.shopify.com/s/files/1/0433/8096/5534/files/archive_magazine_free_download.pdf
- https://cdn.shopify.com/s/files/1/0432/5277/7128/files/83104636872.pdf
- https://cdn.shopify.com/s/files/1/0429/7916/4314/files/lesezuzodilojek.pdf
- https://cdn.shopify.com/s/files/1/0430/6613/0593/files/xegagojububo.pdf
- https://cdn.shopify.com/s/files/1/0437/7319/8487/files/mosobujizojofa.pdf
- https://cdn.shopify.com/s/files/1/0450/4364/6614/files/sql_interview_questions_and_answers_for_freshers_free_download.pdf
- https://cdn.shopify.com/s/files/1/0427/6033/9623/files/26896084894.pdf
- https://cdn.shopify.com/s/files/1/0431/3815/4658/files/podutajufidavijilezepegev.pdf
- https://cdn.shopify.com/s/files/1/0434/4178/2946/files/92386982370.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00008e98.bin7f89109da1d2d9a5c25fda5d6c02df8ec501932b643283ebd4fa1116a1aef6e7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8E98 | 5028 bytes |
font_01_sfnt_off00009f94.bin77bb1202f8c9cdb0d627d75cf30ceaeaf1f5890cd7f5bf2b792b764a02c55df7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9F94 | 9968 bytes |
font_02_sfnt_off0000c1bf.bin4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC1BF | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.