MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/strik?utm_term=angelcare+ac401+price PDF link annotation
- http://gazagidumow.mygamesonline.org/2275591548.pdfIn PDF document text
- https://cdn.sqhk.co/godereliku/ibigRif/instagram_fit_no_crop_for_instagram_apk4fun.pdfIn PDF document text
- https://cdn.sqhk.co/bojojiweg/ighjJpA/89490206990.pdfIn PDF document text
- http://subejewumo.scienceontheweb.net/yoga_asanas_with_steps_and_benefits.pdfIn PDF document text
- http://viwafuxofiseko.getenjoyment.net/antrenmanlarla_geometri_2._kitap.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://1ec9b6e7-17eb-4e1e-a994-ba5ce4cbdb7c.filesusr.com/ugd/d4a9d6_62974a94017b4294bb0c2fbd8a03b276.pdf?index=trueIn PDF document text
- https://69b3109a-7cce-4514-9193-d2106d9976ab.filesusr.com/ugd/3c2969_335492187fa946738674248edc22d15b.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/da07eab1-4161-49a5-b287-36315ac50e78/does_a_sharp_tv_have_a_reset_button.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1aa089ad-11a9-412d-9a86-e8ce8ef9e178/traducir_espaol_a_portugues_brasil_gratis.pdfIn PDF document text
- http://tefetuzuzip.myartsonline.com/john_deere_compact_tractors_near_me.pdfIn PDF document text
- https://8ed7ad90-0d0e-491f-9c15-1f6cd5a61d18.filesusr.com/ugd/f1a804_50a4ec6504aa4d35a8659aa6674f1d5d.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3bb3ab81-2a51-45b2-b482-caa391d1ac0d/what_are_low_carb_bagels.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0891dcbf-594d-464d-ac09-84f61ddc9efa/67903542451.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3e6591f2-a4e6-41fb-907c-332c69f68b25/what_is_the_meaning_of_desktop_publishing.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3f3e9e89-49a1-48d5-ae1b-074a216b1c66/calories_in_dominos_small_cheese_burst_pizza.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/539aa61a-128d-4076-800b-d1d03f1f0dbe/midi_to_sheet_music_online_free.pdfIn PDF document text
- https://ef9935f7-a918-44a1-999f-f1d50a45e4a7.filesusr.com/ugd/b463f2_0d8de28a0c4540acbd24ba840f0df5ef.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/796cce9d-aafe-4777-b068-a3cfabd9309e/donde_comprar_el_libro_un_curso_de_milagros_en_chile.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ee33f51f-9126-477b-b432-b9eb1561eb80/20620505810.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d6c41848-1eda-4797-9c7a-82d02b40fea7/childrens_bible_short_stories.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/02188072-014c-4770-8d47-499d40dd28e8/33197364073.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000efe6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEFE6 | 5192 bytes |
SHA-256: 6a2292d62b765dd39f8f2ce5a524e1174b239ddea02e620647baaaf7e665e8a0 |
|||
font_01_sfnt_off000101b4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x101B4 | 10780 bytes |
SHA-256: 86055618c37d0aae8adda38517bb89c70ccacea85cdbcccceef5a617320b58bf |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.