MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, many pointing to disposable domains, indicating a link farm or SEO spam operation. The ML classifier strongly flagged this PDF as malicious. While no scripts were extracted, the presence of embedded URLs and the heuristic 'PDF_SEO_LINK_FARM' suggest the primary purpose is to redirect users to potentially malicious or unwanted content, disguised as search results.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/strik?utm_term=lakshmi+sahasranama+stotram+tamil+lyrics PDF link annotation
- http://scoretdho.best/maltose_enthalpy_of_formation2es93.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4421461/normal_60312e3627c16.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4472486/normal_601a013e5dbf4.pdfIn PDF document text
- http://gejesixave.scienceontheweb.net/36532217254.pdfIn PDF document text
- https://gopilabuvimira.weebly.com/uploads/1/3/1/4/131453416/kegoz.pdfIn PDF document text
- http://giwapozolaleg.mypressonline.com/9973887778.pdfIn PDF document text
- https://wudusalulolatus.weebly.com/uploads/1/3/1/6/131606476/8574668.pdfIn PDF document text
- http://xivekoto.medianewsonline.com/occupational_english_test_book.pdfIn PDF document text
- https://muwefojiginilu.weebly.com/uploads/1/3/4/5/134512592/momenetene.pdfIn PDF document text
- https://rilinozeni.weebly.com/uploads/1/3/1/0/131070652/2b946.pdfIn PDF document text
- https://xadijonoru.weebly.com/uploads/1/3/3/9/133997446/mepexamugobirasuba.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4416787/normal_600896760454c.pdfIn PDF document text
- http://aycotoro7.xyz/24776551696izmto.pdfIn PDF document text
- http://gavediteriremuv.medianewsonline.com/o_desastre_de_chernobyl.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4390057/normal_6008b066c828b.pdfIn PDF document text
- http://nesobaka9.xyz/what_is_the_best_lego_game_for_ps471wj8.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/86a438d5-d3d6-4672-874b-eb71c406bdae/44383451476.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b09dd6ae-0bc5-469d-b1f0-19e9d92a00ef/does_southwest_visa_have_travel_insurance.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/12bc7ad8-0ebe-484c-a0ab-31cfe7fc3a2c/d-link_dsr-250_firmware_update.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6fa12d86-dde5-4d54-815c-d8d809d034b8/is_deep_freeze_compatible_with_windows_10.pdfIn PDF document text
- http://powagamojij.onlinewebshop.net/attributes_of_a_good_leader.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7afde50c-9a99-4411-90e2-600b08fccaaf/best_sector_to_invest_in_indian_stock_market_2021.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001b26a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1B26A | 4816 bytes |
SHA-256: 434cc1e1ab424f069c85937c3a387bee03df491c688cc1d9431052aac20e696b |
|||
font_01_sfnt_off0001c28f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1C28F | 11016 bytes |
SHA-256: a277e30b86acb007f99874e68749f1c7894890358c315c673f26b60d7f890129 |
|||
font_02_sfnt_off0001e7e3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1E7E3 | 4324 bytes |
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.