Malware Insights
The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/wix?keyword=peace+death+apk+rexdl'. Additionally, it exhibits characteristics of a PDF SEO link farm, with numerous links to external PDFs, one of which is 'https://static.usrfiles.com/ugd/f80014_c4560c1e683e4663b473518f469900cc.pdf'. The document also includes a heuristic indicating it's a password-protected archive lure, suggesting the user is expected to provide a password to access a payload. No scripts were extracted, but the combination of the malicious redirector and the archive lure strongly suggests a malware delivery attempt.
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.cc/wix?keyword=peace+death+apk+rexdl
- https://static.usrfiles.com/ugd/f80014_c4560c1e683e4663b473518f469900cc.pdf
- https://static.usrfiles.com/ugd/b8c837_f638475c55ef479c915449acb3f40f13.pdf
- https://static.usrfiles.com/ugd/b8c837_e0f40f6d51cd4ed3a4cd5aecdc74f11a.pdf
- https://static.usrfiles.com/ugd/b8c837_d5334062b76041b4906fa610bd60d58a.pdf
- https://static.usrfiles.com/ugd/0049ca_136e3b52acfc4a9eab013a68dce21a8f.pdf
- https://static.usrfiles.com/ugd/b8c837_0112073a40784c0b8b3ba496522f7bcf.pdf
- https://static.usrfiles.com/ugd/0baf77_5c038372802a44d79266283ccebf361f.pdf
- https://static.usrfiles.com/ugd/b8c837_161157c80ca949628ceda4d1d843ee1f.pdf
- https://static.usrfiles.com/ugd/b8c837_7f1c85de66dd4687b694c5f26e3a0ccd.pdf
- https://static.usrfiles.com/ugd/b8c837_03e43f3c253b4dedb96b00dbd9981e3e.pdf
- https://static.usrfiles.com/ugd/b8c837_64ccf810d82c4e95b00fd7b0f7cf879f.pdf
- https://static.usrfiles.com/ugd/0c41e7_90c3f1073b9242d9988488c58ba4a046.pdf
- https://static.usrfiles.com/ugd/22739b_ce1bbe804c8e4775b56b6e5522e7ea8d.pdf
- https://static.usrfiles.com/ugd/e4ff69_7c87bec7c7ec46f382aa293698567c5c.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000064d7.bin4be4351d0e2b3c889523e0ddb9eca335a3b465993cafa66537b95a06153d32f4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x64D7 | 4640 bytes |
font_01_sfnt_off000074aa.bin1ffc58b4595aaaf3fb8987aa0e8e015ec046d3f30a9ef7b209cd414bd4fcccdb |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x74AA | 10056 bytes |
font_02_sfnt_off000096d6.bin1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x96D6 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.