MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.me/wix?keyword=hungry+dragon+mod+apk+2.+0'. Additionally, it exhibits a PDF link farm heuristic, embedding numerous external PDF links, with 'https://cdn.shopify.com/s/files/1/0429/3797/4950/files/97773318195.pdf' being the first identified. The document body, though heavily corrupted, contains references to the malicious URL and a seemingly unrelated file name, suggesting a lure to download potentially unwanted software or lead to further malicious sites.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/wix?keyword=hungry+dragon+mod+apk+2.+0
- https://cdn.shopify.com/s/files/1/0429/3797/4950/files/97773318195.pdf
- https://cdn.shopify.com/s/files/1/0433/7578/8182/files/sominajoxipufem.pdf
- https://cdn.shopify.com/s/files/1/0432/5828/2152/files/arterial_system_of_human_body.pdf
- https://cdn.shopify.com/s/files/1/0428/4160/4263/files/40190891584.pdf
- https://cdn.shopify.com/s/files/1/0432/3259/2040/files/jafofasagarotiredajebokun.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/zutowujovepenatugipo.pdf
- https://cdn.shopify.com/s/files/1/0430/8421/8532/files/mojin.pdf
- https://cdn.shopify.com/s/files/1/0438/3349/1616/files/43546290156.pdf
- https://cdn.shopify.com/s/files/1/0429/4157/9420/files/34639763593.pdf
- https://cdn.shopify.com/s/files/1/0435/8730/5629/files/rupesovikanevu.pdf
- https://cdn.shopify.com/s/files/1/0434/1356/9690/files/amniocentesis_nice_guidelines.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/55864873889.pdf
- https://cdn.shopify.com/s/files/1/0429/7143/1065/files/99033764561.pdf
- https://static.usrfiles.com/ugd/9374a7_979442ea695d454580e19e9a513edcb6.pdf
- https://static.usrfiles.com/ugd/d6b5da_33c7cc03c63044a8b7504cbd9437d5f7.pdf
- https://static.usrfiles.com/ugd/6846fe_ba1476f7648144378c86af8865ca4719.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006ba6.bin84936930dc2bc87d33bf006b6486e90dfd72ec3de9b007bc6dbcb8b9282dd4bf |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6BA6 | 5500 bytes |
font_01_sfnt_off00007e59.bin4246d4c09d70ab27f54517469a2d68a06cf148418f93a58f0eb6b39993bf64e9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7E59 | 10896 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.