MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a critical heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.ru/wix?keyword=dragon+ball+z+kai+games+psp'. This URL is presented within the document body, suggesting a phishing or social engineering attempt to redirect the user to malicious infrastructure. The presence of a large number of external PDF links, many pointing to Shopify, further indicates a link farm or SEO poisoning tactic to increase visibility of the malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/wix?keyword=dragon+ball+z+kai+games+psp
- https://cdn.shopify.com/s/files/1/0429/8565/2375/files/zogofaguvegujovowo.pdf
- https://cdn.shopify.com/s/files/1/0428/3210/1543/files/bofidawag.pdf
- https://cdn.shopify.com/s/files/1/0432/7486/2758/files/baaghi_full_movie_in_tamilrockers.pdf
- https://cdn.shopify.com/s/files/1/0431/8488/1824/files/sequin_formal_dress_uk.pdf
- https://cdn.shopify.com/s/files/1/0431/0269/9681/files/ravedisew.pdf
- https://static.usrfiles.com/ugd/837d34_cd458ec8cf0e4fb78679c88375f60ffc.pdf
- https://static.usrfiles.com/ugd/8acad3_fd0f5f58866e4bffb7fb8dd06a639b99.pdf
- https://static.usrfiles.com/ugd/3cb679_4053849e0a384edb90dae07f17b643b5.pdf
- https://static.usrfiles.com/ugd/b8c837_beaf0f4ae0944100b8047c300d0beb16.pdf
- https://static.usrfiles.com/ugd/f3ecbe_5f592710ba41432cb73f2ca5d43afbf5.pdf
- https://static.usrfiles.com/ugd/b8c837_992f0d430cf3468286aeb16cf15a841c.pdf
- https://static.usrfiles.com/ugd/ae059d_b2a16169886144a5b3e5459433165660.pdf
- https://static.usrfiles.com/ugd/696117_956253a041bd4902b41aebffcb9ebdfc.pdf
- https://static.usrfiles.com/ugd/e4ff69_670267d87a4140b4933daa0c7af40b5d.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004c93.bincba7fe976f906c54c3235d4f726e1fb64ec6d30f8980ed934cc659de22d3a491 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4C93 | 3528 bytes |
font_01_sfnt_off0000590f.bina60a41ca54b2673c2fff23b8aced1469297cfb76067e5a45f52eb09d252727eb |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x590F | 5392 bytes |
font_02_sfnt_off00006b5f.bin6cff1b03472c08b8d29f80a6fdbf534341c9d294a35b0e3b05d048ea8a145301 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6B5F | 9908 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.