MALICIOUS
176
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document contains numerous external links, many pointing to Weebly and Strikingly hosted PDFs, suggesting a link farm or SEO abuse for phishing. The primary lure appears to be a fake download for 'Need for Speed Most Wanted soundtrack', redirecting to a URL that likely serves a malicious payload. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document may be instructing the user to open a password-protected archive, a common tactic to bypass gateway security.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/strik?utm_term=need+for+speed+most+wanted+soundtrack+download+2012 PDF link annotation
- https://popokafiri.weebly.com/uploads/1/3/1/4/131437291/506873d302.pdfIn PDF document text
- https://lirodute.weebly.com/uploads/1/3/1/8/131871659/8787569.pdfIn PDF document text
- https://rojanudase.weebly.com/uploads/1/3/0/9/130969060/zilodinagijofijofu.pdfIn PDF document text
- https://zegikawa.weebly.com/uploads/1/3/4/6/134640481/xamorira-nupexubi.pdfIn PDF document text
- https://nugijokokul.weebly.com/uploads/1/3/0/9/130969158/64f8747d1f7.pdfIn PDF document text
- https://danodukuwen.weebly.com/uploads/1/3/1/6/131637043/2684593.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/841ee1c9-81b9-479f-a737-170b447cd85a/how_to_do_foreign_currency_exchange.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5a5f704c-d13d-478d-9612-6b45a30687ad/bolijizoj.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8fdd5b55-f8c1-4596-a99f-80fa975be94f/jusamakikipivalurer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a5064ad0-72e4-4e8b-aded-0fc559801d50/realtek_hd_audio_manager_headphones_and_speakers_at_same_time.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a4433ffb-e6cf-4f56-adf0-55904cd060c4/how_to_program_robertshaw_thermostat.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e87ed8eb-301a-41b9-8aae-25847f22c7ce/3594151548.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/09ed7909-af20-43ed-be48-c7fa74ed838d/dobafojigefarokomes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/16087eb4-5e02-4df9-90b1-0509b216a44b/breville_toaster_oven.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/913b4991-effd-479e-9e8f-82b610606ea2/75691185725.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5a0b5215-b4db-4eea-b925-4f8df5a5fca4/do_temporal_thermometers_read_higher.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f4fac3b0-99c9-439b-809d-c44a35a820f9/new_world_of_darkness.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f1e1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF1E1 | 5752 bytes |
SHA-256: 8d511f87ab5d01d37d19b4c2151a33c0c713b32e8bc6ee285b144d5b58e92bae |
|||
font_01_sfnt_off00010587.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10587 | 11700 bytes |
SHA-256: 41f11112f86e7c163bdd7d87b17875dc416f076d65a5053a87fad2a6bf085139 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.