MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file was flagged by a machine learning classifier as malicious and contains a large number of embedded links, many pointing to Shopify domains. One of these links, https://ttraff.club/wix?keyword=minor+key+signatures+piano, is identified as a malicious redirector. This suggests the document is designed to lure users to malicious infrastructure, likely for further exploitation or phishing.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.club/wix?keyword=minor+key+signatures+piano
- https://cdn.shopify.com/s/files/1/0433/0009/4112/files/tomazujarapul.pdf
- https://cdn.shopify.com/s/files/1/0435/2219/5608/files/farakalopofiruvuse.pdf
- https://cdn.shopify.com/s/files/1/0440/6693/0840/files/frise_chronologique_vierge.pdf
- https://cdn.shopify.com/s/files/1/0436/1447/0302/files/matenowuwowela.pdf
- https://1e5a0b67-b2bd-4735-ac2d-32050f71327c.filesusr.com/ugd/87ad98_570edbd469f14a53aa93b98a0b895e6f.pdf?index=true
- https://884d7d92-59ee-4437-a07f-a661e2a340d9.filesusr.com/ugd/ac8c68_02f9a8db71b34858a66849894f7b514c.pdf?index=true
- https://3a4cd038-e9b7-4d55-a459-9b9f24e35a4a.filesusr.com/ugd/e1c37d_d3f84b6247164e899582eb5a0aba96f8.pdf?index=true
- https://9026fee8-cb30-47f9-8e52-1c8743f2df2e.filesusr.com/ugd/61b8bf_022b9f81f4a64228aba7cf688027e086.pdf?index=true
- https://34501b74-9db9-47ce-a4f5-1ad41c8c6c10.filesusr.com/ugd/a43ec6_0b1bbaae6b7547fe9d3f3fa78b16ce03.pdf?index=true
- https://26c3ff27-b61b-48c5-afd7-9380d48e11d9.filesusr.com/ugd/7d21c0_687b59c2f89d4cd7b3868edea0907f4a.pdf?index=true
- https://cdn.shopify.com/s/files/1/0431/9087/8372/files/waiting_for_godot_book.pdf
- https://cdn.shopify.com/s/files/1/0479/6153/8727/files/leota_middle_school_rating.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/meragavafeduxilaxopuxaw.pdf
- https://cdn.shopify.com/s/files/1/0428/6870/3398/files/cyanobacteria_download.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00007988.bin5657841bfd491ae01ae932334ea81858c2afe096e70dde91011d6e8e40d2f10b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7988 | 5124 bytes |
font_01_sfnt_off00008b21.bin3ab62d8c8ce6ef92f68dfba347c444112bd1a63358d1c73dd95bb297829ebeb2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8B21 | 14412 bytes |
font_02_sfnt_off0000b79a.bin2cfc97915d250804213c9b0e6ad261e0979cd38371fb36ec9174dea58a153a3e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB79A | 16120 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.