MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs point to various PDF files hosted on different domains, suggesting a link farm or a distribution mechanism for further content. The ClamAV detection as Pdf.Dropper.Agent-9578678-0 further supports the malicious nature of this file. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Dropper.Agent-9578678-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Dropper.Agent-9578678-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://magneticminds.weebly.com/uploads/1/3/0/3/130323430/9425364.pdf In PDF document text
- http://lilaclighthouse.com/uploads/1/3/0/5/130539091/zirezilaj-nebire-gepojetotagew.pdfIn PDF document text
- http://compassion-for-kids.org/uploads/1/3/0/6/130604127/05d82b6dda0c1.pdfIn PDF document text
- http://lasalledumoulinneuf.com/uploads/1/3/0/6/130620752/garaw.pdfIn PDF document text
- http://project-atlanta.com/uploads/1/3/0/5/130545627/jamuvi.pdfIn PDF document text
- http://imaginaryfriendskc.com/uploads/1/3/0/5/130551896/1277131.pdfIn PDF document text
- http://youthmetro.org/uploads/1/3/0/4/130476744/4807850.pdfIn PDF document text
- http://365christianseniors.com/uploads/1/3/0/2/130270902/87c9baba5c3.pdfIn PDF document text
- http://lozu.remont-info.com/uploads/2020/01/28/fovutazunitiw_godutof_tomatibol_rakefelarobuf.pdfIn PDF document text
- http://zis.iamhasan.com/uploads/2020/01/29/miwiwasisezebofeg.pdfIn PDF document text
- http://slavbul15.ru/uploads/2020/01/27/jibewazupanadofosub.pdfIn PDF document text
- https://tisejame.weebly.com/uploads/1/3/0/3/130323641/3223189.pdfIn PDF document text
- http://moabarealanduse.com/uploads/1/3/0/2/130287930/9243542.pdfIn PDF document text
- http://cardesign.su/uploads/2020/01/28/cb5a882f1406a.pdfIn PDF document text
- http://lilyseidel.com/uploads/1/3/0/6/130621406/062531c22f8eb.pdfIn PDF document text
- http://sweetoccasions.info/uploads/1/3/0/2/130272557/8e126d0a4b.pdfIn PDF document text
- http://bejelo.pnptogo.com/uploads/2020/01/28/viturefajigepawubi.pdfIn PDF document text
- http://keepyourappointment.com/uploads/1/3/0/4/130436049/pasigisu.pdfIn PDF document text
- http://absystemsllcscam.com/uploads/1/3/0/6/130621506/130621506.html#blumenthal+performing+arts+belk+theater+seating+chartIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000015a3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15A3 | 9220 bytes |
SHA-256: 9db73e6513fc31b389a4f13fcd5629bb201232d6b5b745075f563cefa955f7d6 |
|||
font_01_sfnt_off00006320.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6320 | 16864 bytes |
SHA-256: c5c4954e23a199a2f211eb44b71ed06de7df7562630bd683052b3dc8686f224c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.