MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. Additionally, it exhibits characteristics of a PDF link farm, with numerous links to 'static.usrfiles.com'. The ML classifier strongly indicated maliciousness. The document body, though heavily obfuscated, contains the malicious URL, suggesting a lure to trick users into clicking through to a potentially harmful site.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/wix?keyword=su+ve+ate%2525C5%25259F+indir
- https://static.usrfiles.com/ugd/e8506d_9da51d1c91e048db97e93bf42df2ecf0.pdf
- https://static.usrfiles.com/ugd/b8c837_c76a3f32c82d496a8d562d71bc8f449a.pdf
- https://static.usrfiles.com/ugd/cc089a_12975332d1934b60be2120fc163e46cd.pdf
- https://static.usrfiles.com/ugd/a1fb72_7882d0f8703b49a194b7878b0652cd50.pdf
- https://static.usrfiles.com/ugd/217d68_51a9797dfabc415fb6dfdd9306923225.pdf
- https://static.usrfiles.com/ugd/b8c837_74726b9b4fba41a4a90d5fc8d2fd26b2.pdf
- https://static.usrfiles.com/ugd/8e1900_9dc94508995d451fb1a92a40450588f3.pdf
- https://static.usrfiles.com/ugd/585b1d_66fc947ace1e4173ac4312237c8c14b7.pdf
- https://static.usrfiles.com/ugd/e2b09b_6f5f014b4f4e4c758c0b378ae7a8d789.pdf
- https://static.usrfiles.com/ugd/4b874d_a6d25ae54ea44c448fb4c36b210eb5fe.pdf
- https://static.usrfiles.com/ugd/b8c837_eea862f89f4e476b905f8d61a6bb3ff7.pdf
- https://static.usrfiles.com/ugd/b8c837_c90b7b7f532a4c299ae43acb6a4c2dc1.pdf
- https://cdn.shopify.com/s/files/1/0452/5395/1650/files/calvinism_arminianism_and_the_word_of_god.pdf
- https://cdn.shopify.com/s/files/1/0435/2563/6248/files/kipewatupog.pdf
- https://cdn.shopify.com/s/files/1/0429/7146/3831/files/xanozumopobevabe.pdf
- https://cdn.shopify.com/s/files/1/0428/5346/6271/files/16235068569.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000055b8.bine09ca2d976d2b8fbea20794ba76f540920c9cc56c6b0bef4e628bad95d1faaf2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x55B8 | 5020 bytes |
font_01_sfnt_off000066d3.bin24d7c40c197f8aca40f06a27c4f8ff61d8b4e3396908b7581f444209d9ac47fe |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x66D3 | 10676 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.