MALICIOUS
64
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous embedded URLs, with one specifically flagged as an external URI pointing to 'huntic.ru'. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a high number of distinct hosts and links, suggesting a malicious intent to manipulate search engine results or redirect users to potentially harmful sites. The ML classifier also strongly indicated maliciousness.
Machine Learning
- Nyx PDF Classifier malicious score 0.9647
Heuristics 3
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://huntic.ru/pbw?utm_term=what+are+the+strengths+and+weaknesses+of+psychoanalytic+theory PDF link annotation
- https://cdn-cms.f-static.net/uploads/4472788/normal_602b3e69c730e.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4481397/normal_5ff1bb62de8e1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4458132/normal_6050c5572af89.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/7bcfd92d-3dca-4355-9158-3fe6d299411d/jowijiterinarakunidut.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/94fab6a1-4bc5-4bc3-b46b-99134788c49c/english_second_language_free_lessons_near_me.pdfIn PDF document text
- http://palixazoke.pbworks.com/f/why_will_my_pellet_stove_not_light.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/503f8965-8f74-4da2-9ace-b764fe784fed/84240503497.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0beff6f3-80bc-4486-9881-65b5ecbd903e/how_old_is_miles_morales_in_the_comics_now.pdfIn PDF document text
- http://lufokomarib.pbworks.com/w/file/fetch/144476808/how_to_pair_jlab_neon_bluetooth_headphones.pdfIn PDF document text
- http://mituxap.pbworks.com/w/file/fetch/144423597/destiny_2_easiest_nightmare_hunt_this_week.pdfIn PDF document text
- http://maxasol.pbworks.com/w/file/fetch/144531948/bozifotonumulun.pdfIn PDF document text
- http://xuwuziz.pbworks.com/f/97401012810.pdfIn PDF document text
- http://xovelezid.pbworks.com/f/wezademelogotarikavule.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a18754e7-755a-4182-8665-09a6545fdd71/war_of_the_worlds_epix_cast_2019.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8c940caa-663f-4489-ae01-a49583457ca3/el_amor_en_los_tiempos_del_clera_pelcula_completa_gratis.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3f08198e-91e7-4941-bcec-695bd9ec496a/hoover_steamvac_dual_v_instructions.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d645700f-d362-4c3d-a4f0-d7fc0f39f1e0/80463633489.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/221fe9ab-89d5-4a74-936e-c6ba3b2303ca/claw_hand_deformity_causes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/71cf6d06-995f-4127-b895-8d8a73701cb9/nazizuz.pdfIn PDF document text
- http://tagexoba.pbworks.com/w/file/fetch/144648933/zerogodexukimu.pdfIn PDF document text
- http://tebejeloxid.pbworks.com/f/how_to_solve_45_45_90_triangle_calculator.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7e9b73e5-ca50-44a8-ba47-63db69861a99/how_to_turn_on_sony_sa-ct60bt_without_remote.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010f5b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10F5B | 5688 bytes |
SHA-256: c36f16483fd2ec3689a63e28ead85e8b23f57e08993d4cf9ad111043e1ad7228 |
|||
font_01_sfnt_off000122d7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x122D7 | 11292 bytes |
SHA-256: a133d368db848c9a4929353e6b420b34fd594f013cbc65f70e139b3b1a8f8277 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.