MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains a large number of external links, many of which are on disposable hosting and utilize UTM parameters, suggesting a link farm designed to redirect users to potentially malicious sites. The primary URL, 'https://jumiwimov.ru/strik?utm_term=how+to+get+my+honeywell+thermostat+to+work', is presented as a search result for a common query, likely to trick users into clicking. The ML classifier strongly indicates maliciousness.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/strik?utm_term=how+to+get+my+honeywell+thermostat+to+work PDF link annotation
- http://jalazekesofijot.medianewsonline.com/how_to_fix_a_leaky_water_spigot.pdfIn PDF document text
- https://kesafukiwunutab.weebly.com/uploads/1/3/4/9/134900694/8081c0a98.pdfIn PDF document text
- https://dudunetexuzo.weebly.com/uploads/1/3/1/3/131379759/9489448.pdfIn PDF document text
- https://kenomixu.weebly.com/uploads/1/3/0/9/130969587/1f66cccfe8c4e5.pdfIn PDF document text
- http://rupaduwovuw.getenjoyment.net/bixuxikeramazizepag.pdfIn PDF document text
- http://dosefokinuvulo.mypressonline.com/gonowazexevi.pdfIn PDF document text
- https://mizabago.weebly.com/uploads/1/3/5/2/135299272/bumisidezodode.pdfIn PDF document text
- http://kesuvajeb.scienceontheweb.net/gazunexoxivotawota.pdfIn PDF document text
- https://gabukoxikala.weebly.com/uploads/1/3/3/9/133997771/acce793df03b.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/6e7229b9-a65f-485b-9c06-e57862584f32/pigogomifukumopotisexebo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dfc548f1-76ab-4250-9290-8338d66e2776/10140251421.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/32b661c4-b327-49cf-8c01-6bbbb2179bec/70574966733.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a1d1180f-26d5-4ca5-921b-3cc71ceec4fa/bulidafoketezorubu.pdfIn PDF document text
- http://lowuguja.myartsonline.com/accessory_nerve_anatomy.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5981b39a-ce90-46cd-8987-6d97a624bba0/how_to_set_casio_g_shock_wr20bar.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/788f9b1a-caab-4284-9338-17a6dd27f680/does_ipod_touch_get_ios_13.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/00d4962a-5bc3-47fb-8234-ee51f886d8e9/a_suitable_boy_acorn_tv_review.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/17f9e12e-bbe8-4d04-873e-02994f4d26c3/how_to_connect_a_headset_to_nec_phone.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/61dd53ef-d4d3-428e-8d52-ba409c9a8ad8/53571681307.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6db6213b-ef40-4e89-9fca-acec41ea6740/pexunexutanodipedoduzodog.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cc208e8e-5bf4-42f1-8180-52b2f90350ae/how_to_get_adventure_mode_on_minecraft_pe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/13ffbcd0-5060-42b2-bb1b-27fa8ec33b7a/dukanopuremajojazafuker.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e4a2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE4A2 | 5320 bytes |
SHA-256: d1365fb0cdc6264fde633cd85051c4daa3c1becd586b5b3960eae789c3ace476 |
|||
font_01_sfnt_off0000f6a3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF6A3 | 11016 bytes |
SHA-256: e72c8db60b9238f1896aeb5d9f5303f96db11c2c4745475a6cb244b8ece773af |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.