MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a critical heuristic firing for a malicious redirector link, specifically pointing to 'ttraff.me'. This link is presented in a context that appears to be a lure, referencing 'Citrix receiver android tablet'. The document also contains a large number of embedded links, many of which point to Shopify domains, suggesting a link farm or SEO poisoning attempt. The primary malicious IOC is the redirector URL.
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.me/wix?keyword=citrix+receiver+android+tablet
- https://cdn.shopify.com/s/files/1/0429/2503/1590/files/vocabulary_for_ielts_anneli_williams_free_download.pdf
- https://cdn.shopify.com/s/files/1/0427/7318/4678/files/40344706741.pdf
- https://cdn.shopify.com/s/files/1/0435/6282/7935/files/47217704625.pdf
- https://cdn.shopify.com/s/files/1/0431/3051/9716/files/persuasive_writing_techniques.pdf
- https://cdn.shopify.com/s/files/1/0440/7951/3752/files/lakewawelele.pdf
- https://cdn.shopify.com/s/files/1/0439/2986/2312/files/blindsight_peter_watts.pdf
- https://cdn.shopify.com/s/files/1/0431/0663/1833/files/movies_like_hitchhikers_guide_to_the_galaxy.pdf
- https://cdn.shopify.com/s/files/1/0430/9821/0461/files/jiral.pdf
- https://cdn.shopify.com/s/files/1/0437/8119/3885/files/25284941479.pdf
- https://cdn.shopify.com/s/files/1/0435/8042/4351/files/61084091162.pdf
- https://static.usrfiles.com/ugd/764aaa_5a3c4eb5733d4847a1978ac8ac2c5174.pdf
- https://static.usrfiles.com/ugd/432b07_df3e0f74a7254df7b4da967d20847bc3.pdf
- https://static.usrfiles.com/ugd/269bb8_722f5294068549c5bd20094d177da33b.pdf
- https://static.usrfiles.com/ugd/90423f_1d25b0e5c4cd4cbaaa08ed78aecaefa7.pdf
- https://static.usrfiles.com/ugd/f08e01_d713d9b178b7435ba057341a50276f3a.pdf
- https://static.usrfiles.com/ugd/162fe6_e0a539e3447c42fcbcdc0f1c2acab37e.pdf
- https://static.usrfiles.com/ugd/4fea5c_ec403425690240f4b691a977069044ae.pdf
- https://static.usrfiles.com/ugd/b8c837_4d8a4bc43a6140498cef211b3bd3bf4d.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006b6d.bin9bab56486c4ea646e70019228f8c594ddfd3d3fd92f59093159fd1eb545a3834 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6B6D | 4928 bytes |
font_01_sfnt_off00007c41.bina5d3ed2e11bd149f9df60c5c50d4718239e5cc0d0d50085d3f723dedb92cf2dd |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7C41 | 10856 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.