MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, also contains URLs pointing to external resources. This suggests the primary purpose is to redirect users to a network of websites, likely for SEO manipulation or to serve further malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://iamcouturequeen.com/uploads/1/3/1/3/131397964/131397964.html#simbolos+astrologicos+para+word+part PDF link annotation
- http://smashcancerfgc.com/uploads/1/3/0/8/130874097/384345.pdfIn PDF document text
- http://high-rail.org/uploads/1/3/0/3/130312983/fb6753498fbd.pdfIn PDF document text
- http://burdentransportation.net/uploads/1/3/0/7/130775364/zizipubigap.pdfIn PDF document text
- http://alloneministries.net/uploads/1/3/0/3/130379063/xokevuzuzope-milezisobavuwoz-javov-mojigebareg.pdfIn PDF document text
- http://alexmckamie.com/uploads/1/3/0/5/130588839/2906775.pdfIn PDF document text
- http://unconventionalhope.org/uploads/1/3/0/5/130588513/mulumeta_nerekenuto_sumasuzuteb_zafojuliru.pdfIn PDF document text
- http://lineonfacebook.com/uploads/1/3/1/4/131483197/ramavog.pdfIn PDF document text
- http://thegangstagoddess.com/uploads/1/3/0/8/130814680/negib-vedegob-lisunumo-jozafum.pdfIn PDF document text
- http://centralmooloolah.com/uploads/1/3/0/6/130603850/2780019.pdfIn PDF document text
- http://hopehealthacademy.net/uploads/1/3/0/6/130604803/337222bba6.pdfIn PDF document text
- http://mummaherbssoftplay.com/uploads/1/3/1/3/131381332/gazorekotak.pdfIn PDF document text
- http://mcs-lawyers.com/uploads/1/3/0/6/130620998/xijokujubozusulak.pdfIn PDF document text
- http://tneducatorsconnect.org/uploads/1/3/0/5/130539097/2577732.pdfIn PDF document text
- http://mjbrendering.com/uploads/1/3/1/1/131164524/2721330.pdfIn PDF document text
- http://korurecruitmentnz.com/uploads/1/3/0/6/130621167/0627941c8b50e.pdfIn PDF document text
- http://photovideoarts.co/uploads/1/3/0/5/130588625/6278614.pdfIn PDF document text
- http://yournextheadquarters.com/uploads/1/3/1/3/131382531/pabipewidodikir.pdfIn PDF document text
- http://winstonoptical.com/uploads/1/3/0/4/130435701/4c81ce881.pdfIn PDF document text
- http://tryridecertain.com/uploads/1/3/0/6/130605368/1748413.pdfIn PDF document text
- http://anthemuas.com/uploads/1/3/0/6/130621654/7034796.pdfIn PDF document text
- http://thisgiftedlife.com/uploads/1/3/1/4/131453352/ralagufifekuzubavaz.pdfIn PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00007651.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7651 | 6908 bytes |
SHA-256: 22e85746eefe1866d4b51e8bb45401ce7bbf161aed86a66a22273eade810dd69 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.