MALICIOUS
66
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The ML classifier strongly indicates maliciousness, and the PDF contains numerous external links, many hosted on disposable domains, suggesting a link farm for phishing or malware distribution. The document body, though heavily obfuscated, appears to be a lure related to a school supply list, which is a common pretext for social engineering attacks. No scripts were extracted, but the presence of many URLs points towards an intent to redirect users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9977
Heuristics 4
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://bologen.ru/wix?keyword=honaker+elementary+school+supply+list PDF link annotation
- https://cdn.sqhk.co/kuwusemob/kijchgo/visolonos.pdfIn PDF document text
- http://mirror-x.org/puzuxeq5fxz.pdfIn PDF document text
- http://helper-badges.com/livefezigewozufivurivovj7gq1.pdfIn PDF document text
- https://tivofexogi.weebly.com/uploads/1/3/1/3/131398075/xuzosulezikuniba.pdfIn PDF document text
- http://trelon.fun/918048714956hpqr.pdfIn PDF document text
- http://verifedform.com/what_is_medical_claims_review699g0.pdfIn PDF document text
- http://okclub.org/motores_de_corriente_continua_jos_roldn_viloria08v3u.pdfIn PDF document text
- http://maddot.space/star_trek_enterprise_season_1_episode_4r7boj.pdfIn PDF document text
- http://investmag.org/amoeba_sisters_human_body_systems_answer_keyb35v0.pdfIn PDF document text
- https://zemedabumudog.weebly.com/uploads/1/3/2/7/132712209/gekabuvasazux.pdfIn PDF document text
- http://mebel-albero.ru/how_to_calculate_the_surface_area_of_an_irregular_shapeaeuup.pdfIn PDF document text
- https://cdn.sqhk.co/kapopajij/mJmGs6U/spectra_flange_size_guide.pdfIn PDF document text
- https://zabomefekezene.weebly.com/uploads/1/3/0/7/130740536/3bde6f55019d6.pdfIn PDF document text
- https://dovekawelefirim.weebly.com/uploads/1/3/4/2/134266448/loderexebazimu-navonotironum.pdfIn PDF document text
- https://worudunomazife.weebly.com/uploads/1/3/1/4/131483266/1231898.pdfIn PDF document text
- http://sosed.market/clasificacion_de_la_materia_y_su_relacion_con_la_energian8a5t.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://c7972686-9310-4d97-8ac3-15e828887225.filesusr.com/ugd/8a419d_dba3d04705a546609485b5cdcb675596.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/9c0e4896-1674-4e28-a433-f5c93d383a07/2214168571.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b32ed738-0104-450e-82ce-f7cfc048a6ac/delavusoparevameketijapag.pdfIn PDF document text
- https://0879403c-3be5-48e4-925f-21334a7d5cfe.filesusr.com/ugd/407fcc_17c31c512bff4c099c8c2d1d4ebeda0e.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/fd191ee9-2ff2-4140-839b-0259abccd75a/how_much_to_change_timing_belt_honda_civic.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ca5c7e68-4ee2-461e-8e51-b09148fcdefa/shimano_di2_app_for_mac.pdfIn PDF document text
- https://40785fcd-1e5e-4316-9306-5db1d5795eae.filesusr.com/ugd/2f07a1_ca9b806f14a14311908ed77c7b683e4b.pdf?index=trueIn PDF document text
- https://9e2b3e3a-6a02-4d3b-8ba9-5acc01041672.filesusr.com/ugd/66c878_b27df8a3e7b34de0a4ded0f58cb93a94.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/abdf4841-c07b-480f-b815-d167247f20da/23922791625.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00028251.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x28251 | 5180 bytes |
SHA-256: 5b4bc0819641ba7d54ab9bcd8a87eeb1a38e7d58b770f52041ed84db5e6b7756 |
|||
font_01_sfnt_off000293c6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x293C6 | 11332 bytes |
SHA-256: 76d0bccbd8912a816159efaa455e6d9e98d96996b8fd83b5595c65ef387d4cfe |
|||
font_02_sfnt_off0002b937.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2B937 | 4324 bytes |
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.