MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a heuristic indicating a link farm with numerous external PDF links, suggesting an attempt to manipulate search engine rankings or distribute content. One of the embedded URIs, https://botokaw.ru/strik, is flagged as suspicious and likely leads to a malicious site. The ML classifier strongly indicates maliciousness, and the overall structure points towards a content-luring or phishing attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/strik?utm_term=how+to+find+velocity+of+a+particle
- https://zavodazokexa.weebly.com/uploads/1/3/4/6/134632977/serivunijila.pdf
- https://fojefutitamok.weebly.com/uploads/1/3/3/9/133989463/958f82d4ff37e8.pdf
- https://motikefivenigem.weebly.com/uploads/1/3/4/7/134709332/3041932.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/tuzakifezara/53981253759.pdf
- https://s3.amazonaws.com/lodazojamuva/que_son_las_bases_nitrogenadas_purinas_y_pirimidinas.pdf
- https://s3.amazonaws.com/dexodekelaseki/borland_c_builder_6_full.pdf
- https://uploads.strikinglycdn.com/files/34d03b18-a04d-4d8f-a7a1-5d306ffa4e35/agile_methodology_including_scrum_and_kanban_methods.pdf
- https://uploads.strikinglycdn.com/files/d21c67c2-1666-4f10-b665-c37012ff2325/pijogogikavavanejob.pdf
- https://s3.amazonaws.com/bomupi/berserk_manga_free.pdf
- https://s3.amazonaws.com/tisegovofu/sasevofurifan.pdf
- https://uploads.strikinglycdn.com/files/9521bb9f-cabc-4db8-820c-a418d92d569e/vagifagipaki.pdf
- https://uploads.strikinglycdn.com/files/d0d98956-b6a6-4807-b5db-2017193d7016/duzej.pdf
- https://uploads.strikinglycdn.com/files/f9d43b1c-dbf4-489e-8312-50709805e6a4/does_papa_johns_have_thin_crust.pdf
- https://uploads.strikinglycdn.com/files/f3a4628e-3a5a-4c2e-95c1-3e88a4fb9a27/troy_bilt_tb575ec_fuel_line_diagram.pdf
- https://s3.amazonaws.com/pilazi/idiomatic_expressions_worksheet_for_grade_8.pdf
- https://s3.amazonaws.com/dedinavesute/proctor_silex_coffee_pot_manual.pdf
- https://uploads.strikinglycdn.com/files/d9209be6-09c5-4136-a25d-90baf6eab0de/lexatakizajedufagituk.pdf
- https://s3.amazonaws.com/rujabepifar/basic_accounting_mcq_questions_and_answers.pdf
- https://uploads.strikinglycdn.com/files/f7b8b463-2ad1-45de-97dc-c3b52de16d53/how_to_reset_a_nextbook_to_factory_settings.pdf
- https://uploads.strikinglycdn.com/files/e097da1a-41c5-4a2d-9011-f4b45a7c1c97/71156567915.pdf
- https://s3.amazonaws.com/satuja/camtasia_user_manual.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001121c.bin1be6199db04a3cf87706c183e73308a2a96025a94ef15e3e6323a7145c7f0cf9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1121C | 5188 bytes |
font_01_sfnt_off000123f1.bin09487f7e8f19ef6e1e467fddc7a39adddd56a57fdfb353d07107a796f6cad71b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x123F1 | 11996 bytes |
font_02_sfnt_off00014d6c.bin365c24368114ad1357215bdb10d488652f6572b8635c3ddcd3785be6cada07f5 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14D6C | 16116 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.