MALICIOUS
128
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a high number of embedded links, many pointing to external resources, and specifically includes a link to a known malicious redirector. The document body, though heavily obfuscated, contains text related to 'adm apk mod' and the malicious URL, suggesting a lure to download potentially malicious Android application packages. The presence of a visual download button heuristic further supports this. The primary malicious URL identified is https://ttraff.me/wix?keyword=adm+apk+mod.
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/wix?keyword=adm+apk+mod
- https://static.usrfiles.com/ugd/3fc21f_ea0d748a94ec484b969b87ffab2f9c96.pdf
- https://static.usrfiles.com/ugd/5e8de6_516d783c34a34c879d2141db402bec6c.pdf
- https://static.usrfiles.com/ugd/ac72e0_07870d9f16aa43c68cc1efbb93ade004.pdf
- https://static.usrfiles.com/ugd/d99ef3_d170ded238e64423a118cf3bdd1f6dc5.pdf
- https://static.usrfiles.com/ugd/33a16d_3ff5a4e2b9834647b9c3661d3d84edf3.pdf
- https://cdn.shopify.com/s/files/1/0428/9868/6111/files/98982635997.pdf
- https://cdn.shopify.com/s/files/1/0428/0100/4707/files/43506668141.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/44240048578.pdf
- https://cdn.shopify.com/s/files/1/0434/3070/7356/files/jivak.pdf
- https://cdn.shopify.com/s/files/1/0436/3934/1216/files/bajind_kadambari_download.pdf
- https://cdn.shopify.com/s/files/1/0431/1980/4578/files/5_day_workout_routine_for_beginners.pdf
- https://cdn.shopify.com/s/files/1/0437/1909/8523/files/new_movies_hd_telugu.pdf
- https://cdn.shopify.com/s/files/1/0429/0455/1590/files/87367448368.pdf
- https://static.usrfiles.com/ugd/fa32a6_f437b09403444b9d90abf18116043bb2.pdf
- https://static.usrfiles.com/ugd/b8c837_c4a9303f070e4eaf9df2091cfe583edf.pdf
- https://static.usrfiles.com/ugd/b8c837_df138d8e91464135ba6ad496f8f6ca03.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006be8.bin5157e9938eec70923290079066507a8329207a0dbc8b49d331cbcad1e07d9aff |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6BE8 | 4852 bytes |
font_01_sfnt_off00007c51.bindfab3945eace5ba27be1ad95d63d5142397767eab6bca27773794b33bda2302c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7C51 | 1796 bytes |
font_02_sfnt_off000084db.bin7bd4e65227ce0b84c739ee8a93a0f0e3175241b58ca0b23716ce91a0565949dc |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x84DB | 10364 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.