MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, with a significant number pointing to potentially malicious domains, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The primary URL, 'https://dafemum.ru/strik?utm_term=how+to+make+paper+origami+heart+box', is flagged as unknown reputation. The ML classifier also strongly suggests maliciousness. While no scripts were explicitly extracted, the structure and heuristics point towards a link farm or redirection scheme designed to lead users to harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9964
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/strik?utm_term=how+to+make+paper+origami+heart+box
- https://cdn-cms.f-static.net/uploads/4376086/normal_606595e50cfcc.pdf
- https://vulajavup.weebly.com/uploads/1/3/4/6/134683256/sujeguj.pdf
- https://cdn-cms.f-static.net/uploads/4366664/normal_604de9375aeda.pdf
- https://cdn-cms.f-static.net/uploads/4455375/normal_6066d4a950451.pdf
- https://jomokojexenubi.weebly.com/uploads/1/3/4/8/134877089/duxepedapep-waxevisovomadis.pdf
- https://cdn-cms.f-static.net/uploads/4448094/normal_60640024de42d.pdf
- https://zitujizu.weebly.com/uploads/1/3/4/7/134731650/8ab4dace8c46ae.pdf
- https://cdn-cms.f-static.net/uploads/4453563/normal_6027d959f1c83.pdf
- https://finolija.weebly.com/uploads/1/3/4/6/134625313/6672998.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/4103ec57-e3f2-47a9-92d1-7ba5d2676b55/kijexeribejus.pdf
- https://uploads.strikinglycdn.com/files/d881db34-4a6c-402d-95d1-ea167b6f9e1a/dyson_big_ball_origin_vacuum_cleaner_parts.pdf
- https://s3.amazonaws.com/fovezewi/weather_report_chennai_in_tamil.pdf
- https://uploads.strikinglycdn.com/files/4da4edd2-35e0-4bc3-9047-26151298bc7b/komapulonoba.pdf
- https://uploads.strikinglycdn.com/files/045e2db8-883d-40c1-9e02-d160bd6f389f/75435183816.pdf
- https://uploads.strikinglycdn.com/files/b0a7b29b-4b75-4c5d-9916-352b06a25b4a/asus_rt_ac87u_svensk_manual.pdf
- https://uploads.strikinglycdn.com/files/dcd94535-c9a9-467b-a6a8-29fbaeb41552/how_to_book_a_tattoo_appointment_over_email.pdf
- https://s3.amazonaws.com/gatazeromij/navowatoninitolivonale.pdf
- https://uploads.strikinglycdn.com/files/c9736a94-038f-4ce9-b4a6-c6b328792907/kudar.pdf
- https://uploads.strikinglycdn.com/files/983db191-d8a7-4330-9c6e-4d202904a9fc/how_to_use_a_vicks_vaporizer.pdf
- https://uploads.strikinglycdn.com/files/4cf4c884-c589-47b1-8b4d-a877c0add0e1/cuisinart_k_cup_coffee_maker_descaling.pdf
- https://s3.amazonaws.com/tiluwisulepam/69668164503.pdf
- https://uploads.strikinglycdn.com/files/564eb990-9304-48e7-89a6-d126e8b39f18/59629443496.pdf
- https://uploads.strikinglycdn.com/files/b1efc43e-3640-4805-b91d-a20806c2aa04/how_do_i_do_a_hard_reset_on_my_fitbit_charge_3.pdf
- https://uploads.strikinglycdn.com/files/43cbbc8e-4d04-4efd-aa30-c703c782d245/argumentative_essay_about_school_uniforms_should_not_be_abolished.pdf
- https://s3.amazonaws.com/gifojuxaxeva/arun_barun_kiranmala_full_movie.pdf
- https://uploads.strikinglycdn.com/files/451fbabd-961f-4d07-9cef-fd59724135f3/67700852348.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f413.bindce55f0787c7d87b110406eaf541dc151161bca488b2b7fb23d38c0158ab16e0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF413 | 5348 bytes |
font_01_sfnt_off00010628.bin4c2c2c4b6bd1910368b6e2a249f87feff2ee69f2248dd77403ed2fc8ac312bf9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10628 | 10932 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.