MALICIOUS
128
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains embedded JavaScript and a large number of external links, many of which point to benign Shopify domains. However, one critical heuristic identified a link to a known malicious redirector, 'ttraff.cc', which is used to obscure the final malicious destination. The document body text, while containing keywords related to practice tests, is largely garbled, suggesting it's a lure to encourage clicks on the malicious links.
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.cc/pify?keyword=exam+essentials+practice+tests+cambridge+english+advanced+2+pdf
- http://files.earthandwaterdance.com/uploads/1/3/1/4/131406610/4398f.pdf
- http://files.redmousedesigns.com/uploads/1/3/0/9/130969708/8cca52924.pdf
- http://files.theempoweredyou.com/uploads/1/3/1/4/131406258/5671868.pdf
- http://files.joycerandall.com/uploads/1/3/1/4/131406663/2387307.pdf
- https://cdn.shopify.com/s/files/1/0436/5654/4409/files/public_policy_formulation_and_implementation.pdf
- https://cdn.shopify.com/s/files/1/0436/7400/9753/files/gavivuvinumewaxurakax.pdf
- https://cdn.shopify.com/s/files/1/0433/9482/6396/files/84905962491.pdf
- https://cdn.shopify.com/s/files/1/0428/5900/4070/files/robert_half_2016_salary_guide.pdf
- https://cdn.shopify.com/s/files/1/0431/6394/3067/files/78534048934.pdf
- https://cdn.shopify.com/s/files/1/0437/1048/0537/files/fibazed.pdf
- https://cdn.shopify.com/s/files/1/0437/6671/0433/files/18190378663.pdf
- https://cdn.shopify.com/s/files/1/0449/4550/6459/files/english_lessons_for_grade_1_students.pdf
- https://cdn.shopify.com/s/files/1/0439/3641/5899/files/41560304771.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/gofusibosaduxigagixuvoma.pdf
- https://cdn.shopify.com/s/files/1/0434/8280/8472/files/15909403890.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00005bbf.bin2256ebf07a2dbab41714b53210ec0841e1dc998a40dd523c5aa381291a95ddab |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5BBF | 5924 bytes |
font_01_sfnt_off00006fc5.bin8b568d6b3993fc6a39d85e226010035a53b35d864bbda9cfbf6359ddb7f504c4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6FC5 | 16288 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.