MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a significant number of embedded links, a technique often used to create link farms for SEO manipulation or to hide malicious URLs. One critical heuristic identified a direct link to a known malicious redirector, https://ttraff.club/wix?keyword=chores+and+errands+worksheet, which is highly suspicious. While many other links point to benign Shopify domains, the presence of the malicious redirector indicates a likely attempt to direct users to a harmful destination. No scripts were extracted, but the structure and embedded links strongly suggest a phishing or malware delivery attempt.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/wix?keyword=chores+and+errands+worksheet
- https://cdn.shopify.com/s/files/1/0466/2840/5413/files/ludutoxezibetuzuvuxego.pdf
- https://cdn.shopify.com/s/files/1/0433/4046/4281/files/sharp_aquos_smart_tv_manual.pdf
- https://cdn.shopify.com/s/files/1/0440/3652/2149/files/21453072253.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/29318048561.pdf
- https://cdn.shopify.com/s/files/1/0437/8220/9698/files/33873211679.pdf
- https://cdn.shopify.com/s/files/1/0437/7948/9950/files/91905796635.pdf
- https://cdn.shopify.com/s/files/1/0432/8354/6267/files/psicologia_educativa_anita_woolfolk_12_edicion.pdf
- https://cdn.shopify.com/s/files/1/0460/1407/0945/files/videoder_app_install_free_full_version.pdf
- https://cdn.shopify.com/s/files/1/0432/4796/0232/files/filipino_knife_fighting_techniques.pdf
- https://static.usrfiles.com/ugd/b8c837_67fd2dedf2d34e5fb038e6b26d38895a.pdf
- https://static.usrfiles.com/ugd/43d598_4493c05f54c44a44bc1b9b973f2db675.pdf
- https://static.usrfiles.com/ugd/a107db_042d1c5e037c4327b3da62137502d0f3.pdf
- https://static.usrfiles.com/ugd/20d83a_565ea82598e84110acf2657c1b633a05.pdf
- https://static.usrfiles.com/ugd/760101_8d312788cb8b470790a71d0f60d72f1c.pdf
- https://cdn.shopify.com/s/files/1/0434/0360/8214/files/dewalt_circular_saw_guide_home_depot.pdf
- https://cdn.shopify.com/s/files/1/0433/2702/9400/files/jukasaxu.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/92588710477.pdf
- https://cdn.shopify.com/s/files/1/0447/7802/9213/files/manualidades_con_botellas_desechables.pdf
- https://cdn.shopify.com/s/files/1/0434/7153/6290/files/android_developer_api_guide.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006605.bin2c43c9a21797481bd0e6e08f4848439df20f5d938c06e02f3be5323261bf80f1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6605 | 4944 bytes |
font_01_sfnt_off000076d7.bin8bff6bfc583723cdefda46a89edac8492aae5f84f262852b13950b0a43f3f7ef |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x76D7 | 10380 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.