MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9563
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://oniceh.ru/pbw?utm_term=how+to+prevent+powdery+mildew+on+cucumbers PDF link annotation
- https://zivozisexime.weebly.com/uploads/1/3/2/8/132814465/gepude.pdfIn PDF document text
- https://bifekanivixu.weebly.com/uploads/1/3/1/4/131408854/8540873.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7d952213-bc4a-4051-bf86-5e49cbf802f4/82696023794.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2494f459-b41f-4fa7-b7e0-25a2b0e9c3c0/adobe_premiere_pro_2.0_serial_number_free_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d03440a0-665f-4f42-8285-be5b137cb96b/how_to_pair_my_earbuds.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/44912dad-a22b-484e-a035-cae4b99b047e/38524393105.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/100ed16b-23b5-40e1-81ae-4e97308a982a/kosoganavemonesawosisa.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/edeff58b-0c0b-4260-84ec-ed5a87f374e0/functional_movement_screen_corrective_exercise_progressions.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/77fbf634-3dac-4210-be4c-a779b328c81e/16545869464.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/74aff71e-7171-4b3a-8d3a-f9dacbb891df/types_of_textures_for_drywall.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7111b783-6ec9-45c8-a241-011ae493d8de/37451040060.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2c575528-8f84-4a16-ab4e-fd349cc36f27/nexus_6p_release_date.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/48c22b1a-3925-4a17-9b75-f41fc8055769/watch_pride_and_prejudice_2005_online_free_streaming.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6af15772-b9ad-49f2-a46c-b1e25ffe30f0/silent_hunter_3_download_completo_gratis.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8cd19206-1ba0-4a1b-b726-eb07094050d6/how_to_clean_the_filter_of_a_speed_queen_washing_machine.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4176fe6d-1deb-4dc1-98e3-07d7697a0a99/96592803807.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e20a3e74-d7e3-437e-9316-538d6ad05c50/fupezakiguwupe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6d27bd8e-2ed7-414d-b0ac-f110c6727518/walt_whitman_high_school_alumni_bethesda.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dab472f5-a934-4531-97c5-2db2debf9d9c/how_to_dm_a_dd_5e_game.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2f7ca3bc-f55f-459f-b2f4-3e7ecc41ed48/how_to_remove_icloud_activation_lock_on_iphone_5_without_password.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4d4befc3-a979-4250-8416-a28e3bc8bb84/opticover_ac1200_instructions.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d9a039bf-0f7f-4abc-a2a5-3662ddb95b08/the_pursuit_of_happyness_movie_in_hindi.pdfIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001e38d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1E38D | 3312 bytes |
SHA-256: 633d37747ab9b5972b4223f6fabfb55899b36298ded58a83a6a7a11f9d8a8bd1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.