MALICIOUS
162
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a link to a redirector URL, which is a common tactic for phishing and malware distribution. The document body, though heavily obfuscated, contains text referencing 'Yahoo messenger conversation history' and the redirector URL, suggesting a lure. The presence of a 'Password-protected archive handoff' heuristic indicates the document may be intended to trick the user into downloading an encrypted payload. The file also contains a link farm pointing to multiple PDFs hosted on Shopify, with one specific PDF identified as a potential target.
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/pify?keyword=yahoo+messenger+conversation+history
- http://sokemera.parkcitybrewery.com/uploads/1/3/1/4/131437987/043612ac3.pdf
- https://cdn.shopify.com/s/files/1/0437/0399/2474/files/14548775260.pdf
- https://cdn.shopify.com/s/files/1/0433/9823/4270/files/88620792826.pdf
- https://cdn.shopify.com/s/files/1/0447/3012/2393/files/mopaku.pdf
- https://cdn.shopify.com/s/files/1/0431/9952/9120/files/comment_regrouper_plusieurs_mac.pdf
- https://cdn.shopify.com/s/files/1/0435/1646/1211/files/39126497753.pdf
- https://cdn.shopify.com/s/files/1/0431/4418/3974/files/30175151237.pdf
- https://cdn.shopify.com/s/files/1/0452/0479/9639/files/gosuzikajidiganavofa.pdf
- https://cdn.shopify.com/s/files/1/0427/5660/4070/files/lanenaxu.pdf
- https://cdn.shopify.com/s/files/1/0430/4253/7629/files/causes_and_effects_of_overpopulation.pdf
- https://cdn.shopify.com/s/files/1/0433/7192/1571/files/66850648851.pdf
- https://cdn.shopify.com/s/files/1/0430/4614/2114/files/46201024198.pdf
- https://cdn.shopify.com/s/files/1/0434/4119/3110/files/bmw_r1200rt_service_manual.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006522.binfbe43cf15bccb8d8c4c04ec26084be4ce1cf3a48923b9fa32b004bd442401532 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6522 | 5304 bytes |
font_01_sfnt_off00007711.bina8ba320a0ac8a73a5a8cc2c47ba30bd151ec5f51af4d5ac0b9daf85eaa8f1301 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7711 | 1936 bytes |
font_02_sfnt_off00008056.bin58570abb36a167dd6ff6bb27fd035fa1e17a0e8391795533cd5c90638c1c737b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8056 | 10728 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.