MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains numerous external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The document body, though heavily obfuscated, contains text suggesting it is a 'Smart watch manual t8', which is likely a lure to disguise the malicious intent. The ML_NYX_PDF_MALICIOUS heuristic strongly indicates malicious content within the PDF structure.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://wildchild.dance/uploads/1/3/0/7/130738537/130738537.html#smart+watch+manual+t8 PDF link annotation
- http://jackstevenswelding.com/uploads/1/3/1/4/131452771/8103227.pdfIn PDF document text
- http://coreinformation.net/uploads/1/3/0/6/130622048/b9cdb.pdfIn PDF document text
- http://surreypersonalbest.com/uploads/1/3/0/6/130640191/supizi.pdfIn PDF document text
- http://karasowles.com/uploads/1/3/0/5/130543588/zomovazogasolif_luxurobewudis.pdfIn PDF document text
- http://superhgh.com/uploads/1/3/0/7/130738607/pidawizib-kebagawejof.pdfIn PDF document text
- http://stoprentny.com/uploads/1/3/1/3/131398359/19ae220.pdfIn PDF document text
- http://eshypnosis.com/uploads/1/3/0/4/130483583/9321373.pdfIn PDF document text
- http://omarsamaniego.com/uploads/1/3/0/5/130590778/fitijokorixevo-rozizixutazab.pdfIn PDF document text
- http://modernedgehomeimprovements.com/uploads/1/3/0/7/130740129/lurubixezer-bivixumivogidu.pdfIn PDF document text
- http://workonthehouse.com/uploads/1/3/0/6/130639763/pibotalav.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://www.adobe.com/).NotoIn PDF document text
- http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
- http://scripts.sil.org/OFLNotoIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00005b1f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5B1F | 9680 bytes |
SHA-256: bf3575bbcf9b2d363eae54f73c61fbaa2d91ec1cb17a8755c149347b1f455f37 |
|||
font_01_sfnt_off00007df2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7DF2 | 4184 bytes |
SHA-256: eaa4dde51fd04d4db8dc223d97e5e1aeb2070941b7c144db1acc557f645d9ab7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.