MALICIOUS
92
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains a reference to a product review and the authoring application, suggesting a lure. The primary function appears to be directing users to a vast network of other PDF documents hosted on various domains, likely for SEO manipulation or to serve as a distribution point for further malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://lists.accordionapocalypse.com/uploads/1/3/0/5/130590043/130590043.html#tc+helicon+voicetone+harmony-g+xt+vocal+effects+processor+review
- http://sofiyacattery.nl/uploads/1/3/0/7/130776296/romegajapaberaf.pdf
- http://juliehimes.com/uploads/1/3/0/9/130969079/dosizi_fevegoguxix_tafami.pdf
- http://kristin-guttenberg.de/uploads/1/3/0/4/130483422/9ac54d350df.pdf
- http://scripturecc.org/uploads/1/3/0/9/130969565/9968437.pdf
- http://storyinalocket.net/uploads/1/3/0/6/130604694/6ea6bf1.pdf
- http://thethinkingeffect.com/uploads/1/3/0/3/130323465/1546fb48a8cab8.pdf
- http://aurawakening.com/uploads/1/3/1/0/131069869/kikuweroxalomuvumuvu.pdf
- http://meltoriginalart.com/uploads/1/3/0/7/130739240/7390653.pdf
- http://globalattractionproductions.com/uploads/1/3/1/3/131398368/nobosurubuninizijipo.pdf
- http://theclementcanopysg.com/uploads/1/3/0/8/130813317/lapafazonafozup.pdf
- http://independencebible.com/uploads/1/3/0/6/130604231/koluvefevu.pdf
- http://siobhans.space/uploads/1/3/0/6/130621349/pivomipeso.pdf
- http://paragonsolutionsselect.com/uploads/1/3/0/5/130588968/5027399.pdf
- http://righthandpa.org/uploads/1/3/0/7/130776148/pemedekefixasubenu.pdf
- http://paulcurryelectrics.com/uploads/1/3/0/3/130379067/voduxujix.pdf
- http://teamtodun.com/uploads/1/3/0/2/130289340/sozokeme_pogozinunukifax.pdf
- http://colorfulminds918.com/uploads/1/3/0/4/130489841/1702856.pdf
- http://grupocanela.org/uploads/1/3/0/6/130603855/pedivifepe_wokotelilumewi_pikorusitezidir.pdf
- http://elmcityme.com/uploads/1/3/0/4/130488483/5250196.pdf
- http://shiftingloyalties.org/uploads/1/3/0/7/130775282/muxifa.pdf
- http://clergytaxreturns.com/uploads/1/3/0/6/130620340/6367600.pdf
- http://josweddingchic.com/uploads/1/3/0/4/130483299/zomumu_wirij_rasapewedo_bagelitab.pdf
- http://wgdcnkk.com/uploads/1/3/1/3/131383384/1104292.pdf
- http://www.calyculin.com/uploads/1/3/0/5/130589160/lowij-mujuxipajosiwif.pdf
- http://wgdcnkk.com/uploads/1/3/1/3/131383
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00007aad.bin870879cd28c0d760378da950058ae2187c1416660e20eb4644a6c98f5cf6ee7e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7AAD | 8128 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.