MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains a large number of external links, many of which are hosted on disposable domains, suggesting a link farm or redirection scheme. The primary heuristic indicates an external URI pointing to a URL that includes a search term related to printer issues, likely a lure. While no scripts were explicitly extracted, the PDF structure and the high ML score suggest malicious intent, possibly involving embedded JavaScript to facilitate the redirection or exploit.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/strik?utm_term=why+does+my+printer+say+incompatible+cartridge
- https://xibatelilon.weebly.com/uploads/1/3/1/6/131637149/gakawexomatafuvewi.pdf
- https://cdn-cms.f-static.net/uploads/4408184/normal_6027f3041eb2f.pdf
- http://kind-insta.site/38828709024i6w1r.pdf
- https://cdn-cms.f-static.net/uploads/4457318/normal_6063511151a90.pdf
- https://cdn-cms.f-static.net/uploads/4414866/normal_6043104e0a430.pdf
- http://tokio-2020.fun/46569783053clrtp.pdf
- https://cdn-cms.f-static.net/uploads/4378386/normal_605c87d6227ef.pdf
- https://rikidunojig.weebly.com/uploads/1/3/4/4/134488605/wakesa.pdf
- https://cdn-cms.f-static.net/uploads/4368489/normal_5fd660c061fe6.pdf
- https://cdn-cms.f-static.net/uploads/4458623/normal_602f26cbe5e36.pdf
- http://cabinetsly.xyz/what_is_grounded_theory_methodedxyh.pdf
- https://static.s123-cdn-static.com/uploads/4390350/normal_5fedeb7e42ad9.pdf
- https://cdn-cms.f-static.net/uploads/4496146/normal_60542f4c4998d.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/mefonevimimix/31424443326.pdf
- https://s3.amazonaws.com/mutirexa/16640610541.pdf
- https://s3.amazonaws.com/dujepav/beautiful_flowers_hd.pdf
- https://uploads.strikinglycdn.com/files/8cd4f859-8acc-4e7e-a1f3-a85e9e931664/problemas_de_porcentajes_sexto_de_primaria.pdf
- https://uploads.strikinglycdn.com/files/0372b1dc-cb52-4296-842a-97bbee5e30ff/who_is_on_the_latest_cover_of_sports_illustrated.pdf
- https://s3.amazonaws.com/fotojipifuzitul/where_can_i_buy_a_mustang_mach_e.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d41b.bin06811b113dc2a73cbd7e31954cfb9ae181b10072267fe86c5d9dab06bbec3eeb |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD41B | 5744 bytes |
font_01_sfnt_off0000e788.bina899b3f61a4877e467491597f5e72e75cb0c59f0f6718da076078da6c7edd4c6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE788 | 10276 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.