MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a significant number of embedded links, with a critical heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK and PDF_SEO_LINK_FARM. One of the primary URLs, https://ttraff.com/wix?keyword=Lebkuchen+Frau+Lied, is flagged as a malicious redirector. The document body is heavily obfuscated, but the presence of numerous links suggests a delivery mechanism for malicious content or phishing attempts.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/wix?keyword=Lebkuchen+Frau+Lied
- https://cdn.shopify.com/s/files/1/0427/7692/0220/files/18248075151.pdf
- https://cdn.shopify.com/s/files/1/0447/8281/3341/files/binomial_coefficient_properties.pdf
- https://cdn.shopify.com/s/files/1/0433/0258/4480/files/xarefefabigipuxedo.pdf
- https://cdn.shopify.com/s/files/1/0438/3549/0461/files/50134412214.pdf
- https://cdn.shopify.com/s/files/1/0432/5743/0176/files/protection_domain_5e.pdf
- https://cdn.shopify.com/s/files/1/0438/0744/1053/files/anemias_hemoliticas_en_pediatria.pdf
- https://cdn.shopify.com/s/files/1/0429/3279/7603/files/32760536638.pdf
- https://cdn.shopify.com/s/files/1/0433/6159/9656/files/tween_machine_maya.pdf
- https://cdn.shopify.com/s/files/1/0431/4392/1820/files/mosuxi.pdf
- https://cdn.shopify.com/s/files/1/0433/8624/1189/files/glossary_of_social_science_research_terms.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/99640144283.pdf
- https://cdn.shopify.com/s/files/1/0454/0878/0456/files/zufagejikipuwegodavat.pdf
- https://cdn.shopify.com/s/files/1/0440/0611/3430/files/gegijaxuxuxejoveroni.pdf
- https://static.usrfiles.com/ugd/b8c837_67710c0cfd694f7d96f786230b9ed7a9.pdf
- https://static.usrfiles.com/ugd/ac51ce_a37a908ae77d43528b4d2cdcb03fb16b.pdf
- https://static.usrfiles.com/ugd/b8c837_90ef7077c26f44208d40ebf7a02028cd.pdf
- https://static.usrfiles.com/ugd/97368a_84faac1b30694bae831d6ea773add1cc.pdf
- https://static.usrfiles.com/ugd/b8c837_c20eb92b6cb9488897b5fdd42d1e0f5c.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00007104.binab093159dcb44abf6f7decb467bf63de49b914e267228a654c7f661d4ad390b2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7104 | 5012 bytes |
font_01_sfnt_off00008201.bin41cc8aee52372ede58c04016c51f81dcf01c6607a87a0337d9729cf3a4cca26e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8201 | 12604 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.