MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This technique, identified by the PDF_SEO_LINK_FARM heuristic, suggests an attempt to manipulate search engine results or distribute malicious content through a link farm. The ML classifier and ClamAV detection strongly indicate malicious intent. No scripts were extracted, limiting the analysis of direct execution capabilities.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Dropper.Agent-7955152-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Dropper.Agent-7955152-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://cetonantzin.org/uploads/1/3/0/5/130545581/acb4723544.pdf
- http://fendersupply.com/uploads/1/3/0/8/130814534/denitigevatoxibowuku.pdf
- http://nativeamericanfluteshop.com/uploads/1/3/0/2/130272396/xeripox.pdf
- http://bitsnbytesindia.com/uploads/1/3/0/8/130874180/jilenoxomobojer.pdf
- http://bergen-city.com/uploads/1/3/0/5/130539370/mavonasavosapemuxu.pdf
- http://odessahomeinspection.com/uploads/1/3/0/4/130476649/litoduvu-nebedapun-nudatevegif.pdf
- http://tidalwavesswim.com/uploads/1/3/0/6/130603965/2778902.pdf
- http://iphonegamerguide.com/uploads/1/3/0/5/130589245/1024671.pdf
- http://anothercircle.com/uploads/1/3/0/6/130621142/8435088.pdf
- http://santaquincountrymusic.com/uploads/1/3/0/6/130639034/5353286.pdf
- http://longnecklagooneec.com/uploads/1/3/0/7/130775396/pesusuruwuv.pdf
- http://greenwichunderground.org/uploads/1/3/0/5/130590186/4202692.pdf
- http://imsuperhigh.com/uploads/1/3/0/5/130550729/sunejixik-mafomofuwiveluj-jotejelomomu.pdf
- http://onecampus.live/uploads/1/3/0/6/130639669/jagomabu_matemibaz.pdf
- http://lacollectiva.org/uploads/1/3/0/4/130491001/1428786.pdf
- http://downtothefelt.com/uploads/1/3/0/6/130621167/nuzesujokanag.pdf
- http://neurohorizonpharma.com/uploads/1/3/0/7/130776644/54233.pdf
- http://revivesupportservices.com/uploads/1/3/0/5/130551197/kelap-sibodotidakurop-lazivujofegale-zodowinufomuxe.pdf
- http://inlineuniversity.com/uploads/1/3/0/7/130775715/ef9f91.pdf
- http://notanuffibizans.com/uploads/1/3/0/5/130550817/xulizis.pdf
- http://newzealandlgbtiaward.com/uploads/1/3/0/5/130589191/davowapat.pdf
- http://axispoint.co/uploads/1/3/0/6/130621880/6589657.pdf
- http://podollangpis.devsite-1.com/uploads/1/3/0/2/130289335/kadiror-bebumijido-zuvozovi-galov.pdf
- http://nobakebodycare.shop/uploads/1/3/0/6/130604344/377dd0393a127c.pdf
- http://www.thelearnnplayhouse.com/uploads/1/3/0/5/130551219/7166196.pdf
- http://fitzgerald.rominastiebenphotography.com/uploads/1/3/0/5/130550885/130550885.html#acrylonitrile+butadiene+styrene+material+properties
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004efe.bine8397047731bfd4629467185c5d3107524dee4d99a7520945325aeb852477b6c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4EFE | 16064 bytes |
font_01_sfnt_off0000634d.bin6f21fc8ee677d709726e6d064407d56866956a758a791bbee757be7f6bf96a08 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x634D | 3092 bytes |
font_02_sfnt_off0000713c.bin1b1fdc097f056dfa97ae9d44b338c5b79d15d9853724114796a2180349ed56d0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x713C | 9580 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.