MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF file contains a large number of external links, many hosted on disposable domains, suggesting a link farm or SEO manipulation tactic. The ML classifier strongly indicates maliciousness. The primary malicious URL identified is https://lozipotod.ru/123?utm_term=crystallizing+public+opinion+review, which likely serves as a gateway to further malicious content or exploits.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lozipotod.ru/123?utm_term=crystallizing+public+opinion+review PDF link annotation
- https://cdn-cms.f-static.net/uploads/4406776/normal_601c5e60e48f6.pdfIn PDF document text
- https://cdn.sqhk.co/lukisebeka/CMucLhc/21225676623.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4401696/normal_5fe61a167c21d.pdfIn PDF document text
- http://mynasert.online/taco_bell_veggie_power_bowl_gluten_free78lsu.pdfIn PDF document text
- http://copyright-services-us.com/cholesterol_guidelines_for_type_2_diabetespiq1z.pdfIn PDF document text
- https://cdn.sqhk.co/vazoguzo/ghhhtji/17774697874.pdfIn PDF document text
- https://cdn.sqhk.co/fezajuwu/bjfr41Y/just_dance_controller.pdfIn PDF document text
- http://tehnoprom.org/buvizafagufanutedegar7yl9j.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4459468/normal_5ff46421bdb48.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4444357/normal_6012c1617a6d6.pdfIn PDF document text
- https://cdn.sqhk.co/tifesijoja/jeyFRhf/71980502150.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4405186/normal_6031499cc3cb7.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://a84030a7-2e48-4039-807a-383e2b7216cc.filesusr.com/ugd/c5d40f_0f6ea4ea36374c1e9c106fc03679fa7c.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/12b67a5c-be5d-45c9-8d63-cd99f3fe9219/bebefojesixidup.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8a034d92-1f9c-4ba4-89b6-980226756720/give_two_examples_of_employees_duties_under_the_health_and_safety_at_work_act.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b8754842-cb32-4ef4-9709-86f24a41071e/giraffes_cant_dance_story.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8408f3c2-0c97-495e-be3c-6d580fa4a863/datogumoxikavulonipuru.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d2aa7c05-9b58-4ed1-8c6b-bf3ab120aeb5/zonozibed.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2cacfca9-9553-4838-b81e-74cdf2115613/2013_dodge_charger_engine_3.6_l_v6_for_sale.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/157b9506-eaba-4430-aa73-0120fca90764/en_la_ardiente_oscuridad_sparknotes.pdfIn PDF document text
- https://4e4301d6-cc9a-4939-960a-6b497c1efea6.filesusr.com/ugd/d78803_af8f49eeb9d644f6b4cc4be9c991bc75.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b8ba5ff2-b84f-4ea6-a9e0-8381c2508401/peq_15_pressure_switch.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9edf7a24-515e-441b-b667-887121ac9e96/77761558861.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010102.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10102 | 5448 bytes |
SHA-256: aae78e8fa66a7175e61a03524d6000611f020631e4af13e19e8da6e21b46f3db |
|||
font_01_sfnt_off000113bb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x113BB | 11172 bytes |
SHA-256: 5537b139c22a4a71a75b654c36075ac973edd46477f74f16df91b462aa66bce6 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.