MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a heuristic firing for a malicious redirector link, directing users to a URL that is likely part of a phishing or malware distribution chain. Additionally, the PDF exhibits characteristics of a link farm, embedding numerous external links, many of which point to user-generated content platforms but are likely used to obscure the malicious destination. The document body, though heavily obfuscated, contains the primary malicious URL.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.link/wix?keyword=what+are+some+effects+of+thunderstorms
- http://rowajo.218coopgallery.com/uploads/1/3/2/8/132814261/jegifinedoban.pdf
- http://pobude.zeniefoundation.org/uploads/1/3/1/3/131380771/bebb144bc55.pdf
- https://7f0c3d93-abeb-44f0-b334-ec1252783e78.filesusr.com/ugd/e948c1_d77bf98665414d898764da08c41916bc.pdf?index=true
- https://b36034f0-744e-4486-96ce-0fdec7374583.filesusr.com/ugd/8b4172_bff31abeaffc4e92a77721a9539a0781.pdf?index=true
- https://e4acc868-a591-4bc7-ae4b-ba099293bbcd.filesusr.com/ugd/1ebe14_717abee300cb40f5803effe552360a1e.pdf?index=true
- https://f8ea9158-f453-4e66-bfd3-e63884fa2d06.filesusr.com/ugd/cc3ca9_7f1bc36d7dbe48128f45764f9a99c893.pdf?index=true
- https://09fe53b5-bf70-4456-8b7c-2194b6af27e6.filesusr.com/ugd/b88e3d_b088a39358304295835b537a352bb20b.pdf?index=true
- https://f6c7435e-a9dd-4545-be15-a37574e3ac85.filesusr.com/ugd/4ae4db_f775c53d12664d99ac370c7efa0cdbe5.pdf?index=true
- https://7c2ec7b6-1360-4c32-9057-dfba365d4fe2.filesusr.com/ugd/01bc73_8ef07d59c1a745e996fefc1c09a60a63.pdf?index=true
- https://78e28c7e-6dce-4ef2-b548-8831bae9fa97.filesusr.com/ugd/312e0e_90789cc112a449f9b94d0f974d54fa70.pdf?index=true
- https://5d4e8228-a56e-4cbc-aabd-83979c561069.filesusr.com/ugd/d90490_b856a27c502c4034a58d5add217cc18c.pdf?index=true
- https://884972ab-0d49-4784-88e8-8720273cd5da.filesusr.com/ugd/0d089b_fa29ee1264dd45cab7a586c6207d3ffe.pdf?index=true
- https://e6765dc9-36ec-46e7-98a4-a25c9822183f.filesusr.com/ugd/cc3ca9_45fb91d3012744ce999b3801df27ec3a.pdf?index=true
- https://c0a1e310-57f6-4120-9836-5cdc131cbe93.filesusr.com/ugd/3e5d97_6c31b99082704d6da4c9ca17dfc2cf55.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006b99.bin75590e387fef079965c19f174b478312398b95e64ab7b484fdad1d8736467a30 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6B99 | 5244 bytes |
font_01_sfnt_off00007d53.bin875c751cdc2f63103c034413e8cd962eb7d1d6bad7feaee08da5d69774b1b679 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7D53 | 10672 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.