MALICIOUS
128
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a significant number of embedded links, with a critical heuristic firing indicating a PDF link farm. One of the primary links points to a known malicious redirector, while others lead to numerous PDFs hosted on Shopify. The document body contains garbled text but includes the malicious redirector URL and a keyword related to Instagram bots, suggesting a potential lure for malicious activity. The presence of a large number of external links, including a malicious redirector, indicates a likely attempt to distribute malware or engage in phishing.
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Urgency / deadline lure low SE_URGENCY_LUREDocument contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/wix?keyword=bot+like+instagram+android
- https://cdn.shopify.com/s/files/1/0431/1020/3545/files/brucellosis_ppt_free.pdf
- https://cdn.shopify.com/s/files/1/0437/6422/0055/files/zekigisabuwetiwo.pdf
- https://cdn.shopify.com/s/files/1/0435/5129/3603/files/potixoropuxogoda.pdf
- https://cdn.shopify.com/s/files/1/0431/6109/2250/files/gavufededila.pdf
- https://cdn.shopify.com/s/files/1/0431/2432/6564/files/the_astonishing_lyrics.pdf
- https://cdn.shopify.com/s/files/1/0439/9074/5246/files/28022799729.pdf
- https://cdn.shopify.com/s/files/1/0428/9249/2963/files/assessment_guidelines.pdf
- https://cdn.shopify.com/s/files/1/0464/7531/3302/files/jejeluzizil.pdf
- https://cdn.shopify.com/s/files/1/0431/8697/8984/files/26918573630.pdf
- https://cdn.shopify.com/s/files/1/0434/2956/0486/files/street_fighter_the_animated_series.pdf
- https://cdn.shopify.com/s/files/1/0433/7896/6686/files/kimuwonudisepetubetugiz.pdf
- https://cdn.shopify.com/s/files/1/0434/2956/0481/files/wasifasat.pdf
- https://cdn.shopify.com/s/files/1/0427/8488/2844/files/31707163538.pdf
- https://static.usrfiles.com/ugd/b8c837_89a4ea3ff8a14ee09f582ce94b139d16.pdf
- https://static.usrfiles.com/ugd/b8c837_9e2c51bd73404a989aa91434f55decf8.pdf
- https://static.usrfiles.com/ugd/b8c837_eef65faab57c451da30947b4172d077f.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000614f.bine5d22188a179370c26505ed7be24defa0b473f76ccb55f4a3bd451f2470e08da |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x614F | 5260 bytes |
font_01_sfnt_off00007316.bin312901aa240f37368294080826ad55a4b7b4b60be3468e9e58552cfa5f0279d0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7316 | 10016 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.