MALICIOUS
128
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a critical heuristic firing for a malicious redirector link, which points to 'https://ttraff.ru/wix?keyword=art+contour+line+drawing+worksheet'. Additionally, another critical heuristic indicates a PDF link farm, suggesting a large number of outbound links. The presence of a 'SE_DOWNLOAD_BUTTON' heuristic further supports the lure mechanism. The document body, though heavily obfuscated, contains the same URL, reinforcing its malicious nature.
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/wix?keyword=art+contour+line+drawing+worksheet
- https://static.usrfiles.com/ugd/9a242c_4ff5c866778a48408a2704e5f46620eb.pdf
- https://static.usrfiles.com/ugd/b8c837_a5e70e157be746149adf42f7af666429.pdf
- https://static.usrfiles.com/ugd/1c8c6c_a43dd87b552d4f57b0ee61a1ebcbc9db.pdf
- https://static.usrfiles.com/ugd/451461_5269fe4e948c4a8c868789dd9dddbd11.pdf
- https://static.usrfiles.com/ugd/55f640_cb5f929f7ac14443b9ff0e08fe209ee9.pdf
- https://static.usrfiles.com/ugd/b8c837_08eeb43d05254791a498f9333ada8f1e.pdf
- https://static.usrfiles.com/ugd/0511f5_ee3fb64384ec483ebf668f825b85f55f.pdf
- https://static.usrfiles.com/ugd/19103d_f04222f74d6449f0a4c3dc592f51931b.pdf
- https://static.usrfiles.com/ugd/b8c837_07b7e67539e94b319f124c84ebc7e973.pdf
- https://static.usrfiles.com/ugd/735424_97f8154d5b7f44bcb710de088b21cd2f.pdf
- https://cdn.shopify.com/s/files/1/0436/7053/6345/files/93911341807.pdf
- https://cdn.shopify.com/s/files/1/0430/2887/3367/files/indonesia_visa_application_form.pdf
- https://cdn.shopify.com/s/files/1/0437/4446/0951/files/46941208758.pdf
- https://cdn.shopify.com/s/files/1/0428/5195/8947/files/76588938763.pdf
- https://cdn.shopify.com/s/files/1/0462/1287/4394/files/two_letter_consonant_blends_worksheets.pdf
- https://cdn.shopify.com/s/files/1/0444/7302/4679/files/32891335686.pdf
- https://cdn.shopify.com/s/files/1/0430/3293/6605/files/bookworm_adventures_2_with_crack.pdf
- https://cdn.shopify.com/s/files/1/0431/5168/7848/files/attack_on_titan_browser_game.pdf
- https://cdn.shopify.com/s/files/1/0433/1231/6584/files/diferena_entre_conjuntivite_viral_e_bacteriana.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ac0e.binc27193b6b592ce8e62beac211e0b29b26d78e0e5c5776db1b8ac9b9f2cca5174 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xAC0E | 5348 bytes |
font_01_sfnt_off0000be47.bina413e18efd386ba1f046db743f991cf2ab7b8cecb688fb5d3f06b9ce1edf71e6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xBE47 | 10720 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.