MALICIOUS
92
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of embedded links to external websites, identified by the PDF_SEO_LINK_FARM heuristic. While no specific malicious script was directly executed, the presence of a decompressed JavaScript stream and the sheer volume of outbound links suggest an attempt to manipulate search engine results or redirect users to potentially malicious content. The ML_NYX_PDF_MALICIOUS classifier also flagged this document with high confidence.
Machine Learning
- Nyx PDF Classifier malicious score 0.8959
Heuristics 2
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://photo-file.ru/index.php?article=1574.1&wehsa=1&pdf=1574
- http://www.pieuvre-electrique-toulousaine.fr/index.php?article=2208.1&otafi=1&pdf=2208
- http://power-team.cz/index.php?article=375.3&uwbuc=3&pdf=375
- http://photo-file.ru/index.php?article=813.1&wehsa=1&pdf=813
- http://www.lifedreams.es/index.php?article=1559.1&isbrk=1&pdf=1559
- http://photo-file.ru/index.php?article=2298.1&wehsa=1&pdf=2298
- http://marche-espoir.org/index.php?article=1196.6&xonvf=6&pdf=1196
- http://gchrismanelectric.com/index.php?article=1188.1&txuhv=1&pdf=1188
- http://www.mantrabeautybar.ca/index.php?article=2491.1&rukbv=1&pdf=2491
- http://photo-file.ru/index.php?article=225.1&wehsa=1&pdf=225
- http://photo-file.ru/index.php?article=192.1&wehsa=1&pdf=192
- http://photo-file.ru/index.php?article=2206.1&wehsa=1&pdf=2206
- http://www.fabulaeventos.com.br/index.php?article=2231.1&ipwdu=1&pdf=2231
- http://photo-file.ru/index.php?article=355.1&wehsa=1&pdf=355
- http://kemerimalati.com/index.php?article=1382.3&rlrsj=3&pdf=1382
- http://photo-file.ru/index.php?article=531.1&wehsa=1&pdf=531
- http://www.kingdomfaithchurch.org/index.php?article=957.1&fksac=1&pdf=957
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_000_off000002fd.js63981cc1fa749c8372930191c61c081e5d811855f8607c86d9e30da66a21710f |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x2FD | 13055 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.