MALICIOUS
130
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a link farm, with many links pointing to Shopify domains, but one critical link directs to a known malicious redirector. The document body contains text related to financial accounting and invoice lures, aligning with the 'SE_INVOICE_LURE' heuristic. The primary malicious URL identified is https://ttraff.com/pify?keyword=financial+accounting+previous+question+papers+pdf, which is likely used to redirect the user to a further malicious destination.
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Fake invoice / payment lure low SE_INVOICE_LUREDocument contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.com/pify?keyword=financial+accounting+previous+question+papers+pdf
- http://refisu.sbtcandles.com/uploads/1/3/1/6/131606027/893cafe197f.pdf
- http://zunonu.val6heat.com/uploads/1/3/0/7/130775379/besezodi.pdf
- http://files.monetaventures.com/uploads/1/3/0/7/130775940/xupebuzerakebov.pdf
- https://cdn.shopify.com/s/files/1/0440/2744/5398/files/sweatshop_definition.pdf
- https://cdn.shopify.com/s/files/1/0432/9809/5272/files/how_to_disable_windows_update.pdf
- https://cdn.shopify.com/s/files/1/0435/9582/5320/files/fundamentos_psicolgicos_da_educao.pdf
- https://cdn.shopify.com/s/files/1/0436/1197/9939/files/7th_grade_math_curriculum.pdf
- https://cdn.shopify.com/s/files/1/0434/5148/2278/files/dunubekufavekewuba.pdf
- https://cdn.shopify.com/s/files/1/0435/8835/4207/files/fundamentals_of_astrodynamics_and_applications_vallado.pdf
- https://cdn.shopify.com/s/files/1/0430/4614/2114/files/kebinudowamibamobizaj.pdf
- https://cdn.shopify.com/s/files/1/0430/6996/4439/files/algebraic_expressions_worksheets.pdf
- https://cdn.shopify.com/s/files/1/0431/7318/3637/files/dujanolonep.pdf
- https://cdn.shopify.com/s/files/1/0428/1974/8006/files/bevasezuwi.pdf
- https://cdn.shopify.com/s/files/1/0447/5568/1431/files/bison_the_yacc_compatible_parser_generator.pdf
- https://cdn.shopify.com/s/files/1/0431/2439/2093/files/18660199832.pdf
- https://cdn.shopify.com/s/files/1/0427/8157/3279/files/15244949166.pdf
- https://cdn.shopify.com/s/files/1/0431/8471/7979/files/7082674752.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000047d7.bind5db292aaca80b8057bf4ec0dd4720652c3869c5cf038f1ebb2de6931d03c069 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x47D7 | 5464 bytes |
font_01_sfnt_off00005a75.bina85342de25aa9dffcd81054a831e2efc7b3e9bebf73a29057d9356df571a0f51 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5A75 | 9616 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.