MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a heuristic firing indicating it links to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains a URL that appears to be the primary lure. This URL, 'https://ttraff.link/wix?keyword=monologos+de+com%25C3%25A9dia+curtos', is likely intended to redirect the user to a malicious site. The file also exhibits characteristics of a link farm, with numerous embedded URLs pointing to various PDF documents, suggesting a broader campaign to distribute malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.link/wix?keyword=monologos+de+com%25C3%25A9dia+curtos
- https://static.usrfiles.com/ugd/b8c837_bc4811e10edb45acbd096aa9428404c1.pdf
- https://static.usrfiles.com/ugd/353d00_f4c6c724b44f40b496c1f83a043ebaca.pdf
- https://static.usrfiles.com/ugd/97aff7_2d788e3fb0594b40ba86aca72e6a27d8.pdf
- https://static.usrfiles.com/ugd/b8c837_dde757a805c5400a8fddeb3710c5bad5.pdf
- https://cdn.shopify.com/s/files/1/0435/7590/2363/files/cayman_islands_immigration_naturalization_forms.pdf
- https://cdn.shopify.com/s/files/1/0429/7116/8931/files/vunovaxoluniseduwaraj.pdf
- https://cdn.shopify.com/s/files/1/0434/8090/7938/files/mofoxirabuw.pdf
- https://static.usrfiles.com/ugd/b8c837_2af84211bd3b42d4a2fc601104296d2d.pdf
- https://static.usrfiles.com/ugd/b8c837_97f6b10ce3454c0db85ad522e47a3c50.pdf
- https://static.usrfiles.com/ugd/b8c837_2f01ff7c3d394347bf32dd19df69c6b9.pdf
- https://static.usrfiles.com/ugd/b8c837_ba6ec219be654ee5ba761304c1b9ba71.pdf
- https://static.usrfiles.com/ugd/b8c837_d37f782aa0d8453083f83d42f24afbc5.pdf
- https://cdn.shopify.com/s/files/1/0432/9085/3541/files/33540473375.pdf
- https://cdn.shopify.com/s/files/1/0437/0061/7381/files/2018_annual_franchise_tax_report_delaware_instructions.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000a8eb.binc3171adbcd7bf29d8876d90e6290d3e39fa7c05bee93262ea81ac4fd2bab0f4c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA8EB | 5288 bytes |
font_01_sfnt_off0000ba87.binde524b75bcc96048adad91fd094c79732f908ac4b305bb0857a95f631ab25d02 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xBA87 | 12668 bytes |
font_02_sfnt_off0000e089.bin0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE089 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.