MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains numerous external links, indicating it functions as a link farm designed to redirect users to various websites. The ML classifier strongly flagged this PDF as malicious, and the presence of multiple disposable hosting links suggests a malicious intent to distribute or obscure the true destination. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/strik?utm_term=historia+de+las+religiones+libro+pdf PDF link annotation
- https://cdn-cms.f-static.net/uploads/4464732/normal_6040f7b4897b7.pdfIn PDF document text
- https://vumimexuderuwaz.weebly.com/uploads/1/3/1/8/131871863/6728631.pdfIn PDF document text
- https://ridejotewofo.weebly.com/uploads/1/3/5/3/135314456/lukujebe_nafoxakilipotik.pdfIn PDF document text
- https://pagowabelada.weebly.com/uploads/1/3/0/8/130874520/9809017.pdfIn PDF document text
- https://gekirexuwiri.weebly.com/uploads/1/3/1/4/131452917/pemego.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4479904/normal_6047222d80801.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370068/normal_6026da3cbcc22.pdfIn PDF document text
- https://rowopubogapog.weebly.com/uploads/1/3/4/2/134234702/4223583.pdfIn PDF document text
- https://dulawatekonirul.weebly.com/uploads/1/3/4/5/134589918/wufewigadanotemaxi.pdfIn PDF document text
- https://wojagezut.weebly.com/uploads/1/3/0/7/130775605/757f0ea328de54.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4406170/normal_6042f89538254.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/2dca3b6c-288a-4fce-a469-d21a351c2073/excel_expense_report_template_free_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/405682cd-7e23-4843-976c-4adb1d9db29d/what_are_the_major_landforms_in_canada.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3ab1b511-5f4d-4413-8e35-223f008e9943/essay_writing_advantages_and_disadvantages_of_mobile_phone.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9e5dbe49-a3ee-4e70-bd4a-755a7f4f3f4f/zazaxivemitowoximajol.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/37ae5799-1f19-4ec7-bee7-408c0c21e52e/herman_miller_aeron_chair_size_b_with_forward_tilt.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3fd23a15-e2cb-4d24-b73e-b9ba8be5f067/65608860874.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ad9333fa-f26c-42b7-a51e-7ff6bb44cee3/49589538685.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4ae53d07-18f0-4d69-9d2b-eb4827357188/best_drawing_exercises_reddit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/76bac99b-ff75-4592-b5c1-e0d66b8f4692/twilight_eclipse_cast_renesmee.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/576c04bc-5268-42e8-883e-fe90962580d5/ninja_professional_blender_directions.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8fd44423-3b9b-4cf1-8684-4dc5e4f4ef35/what_is_me_before_you_on.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0ea1c894-ec75-477a-8776-85c121e38cf2/jawbone_up24_price_in_pakistan.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000da04.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDA04 | 5308 bytes |
SHA-256: f87c29761637d5710f84595df4a6d63c1d52dc8e20a65d29b692a8fc5cc0879a |
|||
font_01_sfnt_off0000ec18.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEC18 | 11456 bytes |
SHA-256: 62d457d2e6c768dea4391dc35bf27be6ef1e38fc02083a04e8f854d51c3df535 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.