MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains numerous external links, many pointing to disposable domains, suggesting a link farm or SEO spam operation. The document body, though heavily obfuscated, contains text related to a 'Lapd police report hit and run', which is likely a lure. The presence of many external URIs and a link farm heuristic indicates an attempt to redirect users to potentially malicious or spam content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/123?utm_term=lapd+police+report+hit+and+run PDF link annotation
- http://doridusa.medianewsonline.com/kejumofonewa.pdfIn PDF document text
- http://xitodefigatefuj.medianewsonline.com/boston_airport_map.pdfIn PDF document text
- http://debodopox.iblogger.org/lapewaweberaleg.pdfIn PDF document text
- http://ridaxaki.mywebcommunity.org/livre_pour_apprendre_le_franais_a1.pdfIn PDF document text
- http://kijalixozez.22web.org/ny_times_book_review_a_little_life.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://f74ea38a-ab8d-49a0-8d31-9a1d7ce64423.filesusr.com/ugd/5ceade_b18b70899d384d03a4ef0df03619fa7d.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/vabedafozo/51635484605.pdfIn PDF document text
- https://3f054cde-0430-4828-89d0-5f77035cf230.filesusr.com/ugd/d93890_65961e522a2c4ac4b75724f5e9531853.pdf?index=trueIn PDF document text
- https://41fe7446-7195-45c8-906d-de5e784989f9.filesusr.com/ugd/e02969_7fdb8f9a487249f89934c511c6429315.pdf?index=trueIn PDF document text
- https://33c7e2ec-32fc-4676-a642-9d95a4379e01.filesusr.com/ugd/622218_ae7ce8063737480397f572e761533adf.pdf?index=trueIn PDF document text
- https://cf176ec6-4820-456b-adf9-61e5f06c968f.filesusr.com/ugd/43d598_84554973053a45fe820a445adfadb880.pdf?index=trueIn PDF document text
- https://c183b790-cb34-49aa-848e-1a9f2b14dda3.filesusr.com/ugd/d8966e_58fe22e794104eee94443e021f7f4ee9.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nalifij/graduation_project_presentation_template_ppt.pdfIn PDF document text
- https://67dc9804-4028-4298-afd7-d431d2c16fe6.filesusr.com/ugd/559c84_9d1030ded8664327a28232514fb19869.pdf?index=trueIn PDF document text
- https://d3dd75b0-514a-4dbf-a1f7-973a5b421fb1.filesusr.com/ugd/5b46ec_414d5f2c2aa14d5b96a0fe8b94903757.pdf?index=trueIn PDF document text
- https://3d3b31fc-6152-41c7-b1d4-a4af3afcce63.filesusr.com/ugd/3f8d85_6d06d430cde947059ee83a1c7caf8601.pdf?index=trueIn PDF document text
- https://e082b6be-64c0-45f6-a8ff-82b9c6f476f0.filesusr.com/ugd/1479de_5276df4b2c0447a7a81008e75e2dbc04.pdf?index=trueIn PDF document text
- http://dilepivulibav.epizy.com/baidyabati_weather_report.pdfIn PDF document text
- https://s3.amazonaws.com/bagisi/breville_juice_fountain_elite_cold_press_juicer_uk.pdfIn PDF document text
- https://s3.amazonaws.com/jivuxo/36471978310.pdfIn PDF document text
- https://2e03c77f-99cc-4591-9807-54d8d49c9ce6.filesusr.com/ugd/759733_85f07c07f3084ebab955a76921e853f9.pdf?index=trueIn PDF document text
- https://46d16763-6c5f-4e19-aa2c-3f4071fcbec2.filesusr.com/ugd/26f730_3bdd09f318c542898c767f20e05e5af3.pdf?index=trueIn PDF document text
- http://sakigekoxigukil.epizy.com/82377957898.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e480.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE480 | 4924 bytes |
SHA-256: ff7e422ebaa911ab1fb0fc68ab53fc52544db6df7384023ee434af716b5eb473 |
|||
font_01_sfnt_off0000f53c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF53C | 10704 bytes |
SHA-256: da398e8085ac2d9fc6ffd27c4ec787ac652271faa5ed506af74c654acc80b4c7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.