MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK, indicating it points to a known malicious redirector. The document body, though heavily obfuscated, contains text referencing 'Fluke 1520 megohmmeter manual' and the malicious URL 'https://ttraff.cc/wix?keyword=fluke+1520+megohmmeter+manual'. This suggests a social engineering lure to redirect users to a potentially harmful site. The PDF_SEO_LINK_FARM heuristic also indicates a large number of external links, further supporting a malicious intent to drive traffic.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.cc/wix?keyword=fluke+1520+megohmmeter+manual
- https://cdn.shopify.com/s/files/1/0432/8967/3888/files/bitmap_books.pdf
- https://cdn.shopify.com/s/files/1/0436/3878/4158/files/79415327044.pdf
- https://cdn.shopify.com/s/files/1/0435/6649/7960/files/trx_exercises.pdf
- https://cdn.shopify.com/s/files/1/0429/9476/1877/files/lupanivote.pdf
- https://cdn.shopify.com/s/files/1/0432/3826/0898/files/95719648440.pdf
- https://static.usrfiles.com/ugd/90c678_5f948f3145b04ec3ae7bfd9aafe6141f.pdf
- https://static.usrfiles.com/ugd/5438e3_5a585d5af2ab43ab8ed9e3c19ea2b3a1.pdf
- https://static.usrfiles.com/ugd/39cb9d_9342bf4bbbb64697945a77dff7bfe653.pdf
- https://static.usrfiles.com/ugd/cbe7f7_1df4cf546822457eac54b260897f3d3b.pdf
- https://static.usrfiles.com/ugd/2f7815_106efc6328e0497dbc00e8b4abc1aa20.pdf
- https://static.usrfiles.com/ugd/b8c837_042ded1c11234268b377a95cc34b3e07.pdf
- https://static.usrfiles.com/ugd/d9d1f5_a493c9d52b174d8eb3c5c16744f34dc3.pdf
- https://cdn.shopify.com/s/files/1/0433/7968/7587/files/at_home_workout_plan_without_equipment.pdf
- https://cdn.shopify.com/s/files/1/0431/5339/1782/files/92302148439.pdf
- https://cdn.shopify.com/s/files/1/0430/9411/4453/files/jabefikefapijarawu.pdf
- https://cdn.shopify.com/s/files/1/0440/7758/0453/files/iron_cementite_phase_diagram.pdf
- https://cdn.shopify.com/s/files/1/0440/5064/5157/files/dumb_update_android_app.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006595.bin77466e78e7f70147b5f30dd151d70e4c636d6e6d5e574c066a0857a50015b7e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6595 | 5388 bytes |
font_01_sfnt_off000077cb.bin5d243cc0b89588f6b495a771b29972959e753c7d8dd493f36be31bd56763cd27 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x77CB | 14848 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.