MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of embedded external links, a technique commonly used in phishing campaigns to redirect users to malicious websites. The ML classifier strongly indicated maliciousness, and the PDF structure suggests a link farm designed to host or distribute further malicious content. No scripts were extracted, but the sheer volume of external links points to a high likelihood of malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://wcd-qe6b02fu.mgh-r.ch/uploads/1/3/0/5/130589219/130589219.html#butyl+rubber+sheet+nz
- http://hostmaster.manchesterbusinessradio.co.uk/uploads/1/3/0/3/130313070/fewibonudaril.pdf
- http://www.vetsmithbermuda.com/uploads/1/3/0/9/130969932/4463213.pdf
- http://mpowerempire.com/uploads/1/3/0/6/130604806/xujamofezo-kazixofijura-firexapusuvozim-dajotulavegubo.pdf
- http://juantaborda.com/uploads/1/3/0/4/130477719/lozenikufab-nitep.pdf
- http://mrannounceit.com/uploads/1/3/0/7/130776075/2246782.pdf
- http://mipropiotechoinmobiliariasas.com/uploads/1/3/0/3/130379251/zijulusosa-pajorododin-bezagulug-kowigufisa.pdf
- http://lickatoad.com/uploads/1/3/0/3/130323199/7451209.pdf
- http://cmcgill.com/uploads/1/3/0/5/130538956/33db13.pdf
- http://485harrison402.com/uploads/1/3/0/3/130323937/rekepo_gebapiminegafej.pdf
- http://byggsok-ost.no/uploads/1/3/0/7/130740128/wukop.pdf
- http://momopets.co/uploads/1/3/0/2/130270768/7626850.pdf
- http://cpanel.bizblog.hk/uploads/1/3/0/6/130621212/famoxufofafawe.pdf
- http://tampalandscapedesign.com/uploads/1/3/0/6/130603874/xatomujigijej.pdf
- http://biblesforchinaphotos.com/uploads/1/3/0/3/130323290/nujabuzawi.pdf
- http://www.bodymindandsport.club/uploads/1/3/0/4/130476102/8404a2bcb.pdf
- http://krdrecruitment.com/uploads/1/3/0/5/130588573/0eb0dbb95b639d.pdf
- http://homeartscontentandcopywriting.com/uploads/1/3/0/7/130776157/wadepup.pdf
- http://carterslearningcenter.com/uploads/1/3/0/2/130271211/fabanevepujebemolin.pdf
- http://deafsignsandwonders.com/uploads/1/3/0/4/130488875/5589715.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006d9b.bin5b46333b6d890fae94b0064a59832b4fa6b50673af46b26f65bf9619ce5f3578 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6D9B | 8096 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.