MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous embedded links, many pointing to Weebly-hosted PDF files, suggesting a link farm or SEO poisoning tactic. One prominent URL, 'https://traffset.ru/aws?keyword=gameboy+advance+emulator+for+pc+apk', is presented as a search result, likely to entice users to click and download a malicious payload. The ML classifier strongly indicated maliciousness, and the PDF structure itself is flagged for containing a mass external link farm.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://traffset.ru/aws?keyword=gameboy+advance+emulator+for+pc+apk
- https://nixejovebomir.weebly.com/uploads/1/3/1/3/131380485/vadus.pdf
- https://vonubaxuted.weebly.com/uploads/1/3/1/4/131452839/tujimuxegexug_mekikizo_towekarevi.pdf
- https://sipexagugiresu.weebly.com/uploads/1/3/4/6/134607427/rekagarid.pdf
- https://wobomiti.weebly.com/uploads/1/3/4/5/134501920/9566599.pdf
- https://mojivimimujovo.weebly.com/uploads/1/3/0/8/130874437/menedo-fodizelusekom.pdf
- https://gukaguse.weebly.com/uploads/1/3/1/3/131398473/suvib-labifoxorisod-wevakimilirori.pdf
- https://cdn-cms.f-static.net/uploads/4408355/normal_5f924429bb785.pdf
- https://betoxugibujimiv.weebly.com/uploads/1/3/1/0/131071043/kenebazedotak.pdf
- https://lefedatit.weebly.com/uploads/1/3/0/7/130776734/5c6ad5c.pdf
- https://kalabuzamebuku.weebly.com/uploads/1/3/4/3/134339718/d74330c300394.pdf
- https://baxolelal.weebly.com/uploads/1/3/4/6/134625426/suxejikujowegev.pdf
- https://cdn-cms.f-static.net/uploads/4465136/normal_5fa7a31253557.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/baxadelefofibuz/subexebajoje.pdf
- https://s3.amazonaws.com/tanikanaw/lujaderogeviwinupo.pdf
- https://nopebukivaw.files.wordpress.com/2020/11/89649154479.pdf
- https://tovijid.files.wordpress.com/2020/11/91630450751.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000672c.binac61c1f3d99f3061fe5a2235a61acd86e5d349199877d9c608f647a4d11d5253 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x672C | 5520 bytes |
font_01_sfnt_off000079eb.binc88bb3b02ca1f51a52118901cb53666f36f996256dced741922c79c6d6e34022 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x79EB | 10956 bytes |
font_02_sfnt_off00009fc3.bin2a5f1667c2e343500efde63e3dd6a136498333968b1680966ac5eb34589f1174 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9FC3 | 16144 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.