MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of embedded links to external websites, indicating a link farm or SEO spamming attempt. The primary URL found in the document body, http://stopeurocide.com/uploads/1/3/0/8/130874257/130874257.html#navy+special+request+chit+electronic+signature, is part of this network. The heuristic PDF_SEO_LINK_FARM firing confirms the presence of 30 such links, suggesting a coordinated effort to direct traffic to potentially malicious or deceptive content. No scripts were extracted, but the extensive linking pattern is a strong indicator of malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://stopeurocide.com/uploads/1/3/0/8/130874257/130874257.html#navy+special+request+chit+electronic+signature
- http://horsleyheightsestate.com/uploads/1/3/0/6/130620317/91cffce.pdf
- http://revealthetrueyou.info/uploads/1/3/0/4/130476984/guloliwabotoruvo.pdf
- http://topdollar4junk.com/uploads/1/3/0/5/130545278/zipofuvokonu.pdf
- http://canalgate.org/uploads/1/3/0/7/130775929/resepaxu.pdf
- http://msaswag.com/uploads/1/3/1/3/131383958/melutawibar-jisetubamuw.pdf
- http://atmos-home.com/uploads/1/3/0/8/130814845/2941517.pdf
- http://guilderlandbbc.org/uploads/1/3/0/3/130323208/pubopiwedeziviz_luxuwotu_fujagunutijini.pdf
- http://thehanger243.com/uploads/1/3/0/2/130270796/4238734.pdf
- http://motorhome-biker.com/uploads/1/3/0/6/130620700/5198472.pdf
- http://aeem.com.au/uploads/1/3/0/3/130323968/gewexax_guremidenijis_fafoziwexabuk.pdf
- http://lydiahelpministry.org/uploads/1/3/0/6/130620609/pegazedemekefo_wuzifaranivupul_wupezoguzemeb.pdf
- http://mentalhealthyouthteacher.com/uploads/1/3/0/6/130621634/kawonosew.pdf
- http://theblendedbrunette.com/uploads/1/3/0/6/130605347/1947277.pdf
- http://www.harberer-wedding.rominastiebenphotography.com/uploads/1/3/1/0/131069934/laxumotegu.pdf
- http://karlhicksmodernwood.com/uploads/1/3/0/6/130621390/rotug-gavupawozeg.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00007342.bin124e29ef7f1ef39bb47dd7454854d808ba9170c831a18a51b9e60b987a56f6c0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7342 | 8236 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.