MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains a large number of external links, many of which are structured as PDF files with numeric slugs, suggesting a link farm for SEO poisoning or malicious redirection. The document body, though partially obfuscated, contains text related to a 'Toyota corolla s 2015 service manual' and references to wkhtmltopdf, likely a lure to encourage clicks on the embedded URLs. The ML classifier strongly flagged this PDF as malicious.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://adsl-63-204-18-8.benefitplans.org/uploads/1/3/0/6/130605167/130605167.html#toyota+corolla+s+2015+service+manual
- http://oregoncoastbusiness.com/uploads/1/3/1/4/131408942/3235187.pdf
- http://bothooq.net/uploads/1/3/0/4/130435888/d595b9ec9.pdf
- http://bobolasnashua.com/uploads/1/3/0/7/130739349/vidufum_guzuwilivelon_nomiba.pdf
- http://vivagroupusa.net/uploads/1/3/0/3/130323162/4568e978bb7.pdf
- http://tylerjohngibson.com/uploads/1/3/1/1/131164499/3342293.pdf
- http://escapekewanee.com/uploads/1/3/0/6/130639840/lerege_kojezogorudaxo_vipifaraj_logurivet.pdf
- http://adoptcleancopper.com/uploads/1/3/1/1/131164308/cf84a34.pdf
- http://weenies.online/uploads/1/3/0/5/130589240/bisobawemoxugodod.pdf
- http://tlos4tes.com/uploads/1/3/0/5/130545800/3765673.pdf
- http://thecorporatedictionary.net/uploads/1/3/0/3/130323285/6084c5b4ca9e19.pdf
- http://wollarsolar.com/uploads/1/3/1/3/131380899/6b4b0129.pdf
- http://psbmb.org/uploads/1/3/0/2/130291593/fa3b3c0a5.pdf
- http://smeacademy.se/uploads/1/3/1/3/131381363/4fb50da2292.pdf
- http://tedrabinowitzcopywriter.net/uploads/1/3/0/6/130639140/luviwiwatadoko.pdf
- http://doreenvelin.com/uploads/1/3/0/7/130738994/fowatiwaluga.pdf
- http://truthcm.com/uploads/1/3/0/5/130589998/lafepevezizid-bupudezezej-rupufutizukenu-rurugavef.pdf
- http://achieveeducationalpartners.com/uploads/1/3/0/6/130604940/jawufedimosi_miwam_witedunuzasar_fanatabisir.pdf
- http://voltdesignz.com/uploads/1/3/0/5/130590511/9eaa53a94.pdf
- http://strykaposephotography.com/uploads/1/3/1/3/131381374/kuzil.pdf
- http://cascadeinvestor.com/uploads/1/3/0/9/130968972/xobasupudarene.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000072d8.bin10dbbef287514a1f5982d40d5e1e0e93826b575b5ed16aeab3923c8bc47cea91 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x72D8 | 7836 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.