MALICIOUS
92
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF document contains a large number of external links, many of which point to seemingly unrelated websites with numeric or book-themed slugs. One of the primary links, 'http://thesoonernetwork.com/uploads/1/3/0/4/130489467/130489467.html#how+to+train+your+dragon+the+complete+book+of+dragons+pdf', suggests a lure related to a popular book title. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external links generated to manipulate search engine results, a common tactic for phishing or malware distribution sites. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://thesoonernetwork.com/uploads/1/3/0/4/130489467/130489467.html#how+to+train+your+dragon+the+complete+book+of+dragons+pdf
- http://beecauseaustralia.net/uploads/1/3/0/3/130324011/acc9925af2bdd.pdf
- http://kamilslesinski.com/uploads/1/3/1/4/131438747/4106839.pdf
- http://wiccadsisters.com/uploads/1/3/0/8/130813403/nuwuderewa-ladawu-baripozija-xupego.pdf
- http://canadastrings.ca/uploads/1/3/0/5/130551418/jusabo.pdf
- http://the-coffeeshop.net/uploads/1/3/0/4/130477110/vijekuwon.pdf
- http://harrysbakery.org/uploads/1/3/0/6/130604421/wuwoj-xadunaxo-jopuze-paleziwikaj.pdf
- http://dmvluxurylimo.com/uploads/1/3/0/5/130588533/banorizubosumoraf.pdf
- http://destinationdays.com/uploads/1/3/0/9/130969329/batakuxarufubidomeg.pdf
- http://culebrasailingcharters.com/uploads/1/3/0/5/130551536/9385842.pdf
- http://mydigitalpresence.com/uploads/1/3/0/4/130490687/sokekipopogabut_rozufa_jebudijazojebe_tonuxovelevisew.pdf
- http://perrirossi.com/uploads/1/3/0/5/130552097/8636879.pdf
- http://matlachaartgallery.com/uploads/1/3/0/2/130287441/tiware.pdf
- http://talk-of-the-town.net/uploads/1/3/0/6/130639599/2f28cfe9.pdf
- http://1too0.com/uploads/1/3/0/4/130475989/saperonafig.pdf
- http://www.randmc2019.com/uploads/1/3/0/4/130477346/sadajokirus_jowexomogetor_dizepijelala_jekozezotunanuf.pdf
- http://dcuniquedesigns.com/uploads/1/3/0/7/130738559/3804564.pdf
- http://kristenandluis.net/uploads/1/3/0/2/130289242/ff34a65a4add179.pdf
- http://napervillebedbugs.com/uploads/1/3/1/3/131383384/e67c1.pdf
- http://pragyamishra.com/uploads/1/3/0/6/130620515/lowovirorajer_guredux.pdf
- http://nirunutrition.com/uploads/1/3/0/8/130814856/e5acb.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006958.bin85630a7e15e0552629aac383c0506be03c768b70571f6dd928a3a8f4b18adebd |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6958 | 7624 bytes |
font_01_sfnt_off00008748.bine91619dfd4c72a85464d95ef1ba4e67df13020651c42071bafbe521a61d9f7fc |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8748 | 2652 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.