MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9967
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/wix?keyword=minn+kota+trolling+motor+specs PDF link annotation
- https://zuzivosojix.weebly.com/uploads/1/3/0/7/130775151/1008291.pdfIn PDF document text
- http://dokaxirugik.medianewsonline.com/bullying_essay.pdfIn PDF document text
- http://lubenoredeji.mypressonline.com/gamavukepurunovim.pdfIn PDF document text
- https://cdn.sqhk.co/gizukakom/hQgdKPR/gusinoduvasazi.pdfIn PDF document text
- https://cdn.sqhk.co/rogolafu/diizjjl/talismanic_in_a_sentence.pdfIn PDF document text
- https://veworokog.weebly.com/uploads/1/3/1/6/131606039/5bd4c4d95f6fa5a.pdfIn PDF document text
- https://tunomofezu.weebly.com/uploads/1/3/2/3/132303147/zojisuzunikivo.pdfIn PDF document text
- https://mojurakikaluno.weebly.com/uploads/1/3/1/4/131438245/xemoputoferif.pdfIn PDF document text
- https://rixafewokeget.weebly.com/uploads/1/3/0/7/130739987/dodaxu_vinibudu_jujepujife.pdfIn PDF document text
- http://kexolifowuj.medianewsonline.com/kebutuhan_dasar_manusia_1.pdfIn PDF document text
- https://cdn.sqhk.co/bimolixumotu/cZDhcjg/looper_movie_download_in_tamil.pdfIn PDF document text
- https://cdn.sqhk.co/wepurodapike/gdaljim/prison_escape_puzzle_walkthrough_level_5.pdfIn PDF document text
- https://cdn.sqhk.co/xupumekejaxa/ijbjdhg/fortress_under_siege_wiki.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://43081b45-6e48-4b43-b724-9328fda377ae.filesusr.com/ugd/26481d_4960ba9d947e43e4a4b49206d6707f55.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b8ed867a-9cde-4029-8f2e-cdcb5fd12728/91817754122.pdfIn PDF document text
- https://s3.amazonaws.com/sutawowirosuvuv/8480643500.pdfIn PDF document text
- https://s3.amazonaws.com/toguvaju/receptive_and_expressive_language_development_chart.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d677b050-d915-425e-8dbb-6dea3fe4b3f7/how_long_to_gre_scores_take_to_send.pdfIn PDF document text
- https://91953a53-6f32-4f2a-9b2e-0f954541ff31.filesusr.com/ugd/dad90e_708b975cedbe4034afa8d7e1ec9fbda1.pdf?index=trueIn PDF document text
- https://184d393c-d2ff-49e5-bbcb-48626b1dbf88.filesusr.com/ugd/49be48_b7d30f072b3d41778c79cbaa085061e0.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b80c64ba-57f5-4ad1-9233-480d6431c2a1/dyson_small_ball_multi_floor_upright_vacuum_manual.pdfIn PDF document text
- https://29159626-56e2-4eb2-a8c1-eb081f451e44.filesusr.com/ugd/a58502_e3ddc4c8484b4c3fb94eb10a03cfc160.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/kulinisokakewi/kesakipuxu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/84fb6603-bde3-4636-ae73-f13b85291a0e/tipazuwitemabuxelawo.pdfIn PDF document text
- https://eadb47d6-6712-4ecd-aa5a-2cdcf2d90b86.filesusr.com/ugd/c844bf_3319de5eea704d6ab73f3cb41df1eeff.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b6e5b2d9-e391-4b79-96b5-948d924bf05f/viewtv_at-164_troubleshooting.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f3ec.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF3EC | 5320 bytes |
SHA-256: 40baf62e327632eabe34e54f120bd6335def134e82c70cb790d31f60014f2811 |
|||
font_01_sfnt_off00010602.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10602 | 11592 bytes |
SHA-256: c80fc7bc0342aff8f086e18d4a057807417aca53eda5c8d24c6e553045a13f48 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.