MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many hosted on disposable domains, indicating a link farm or SEO spamming operation. The embedded URL and the document body suggest a lure related to essay writing examples. The ML classifier strongly flagged this PDF as malicious, and the presence of numerous external links points towards a malicious intent to redirect users. No scripts were extracted, but the link farm nature is a strong indicator of malicious activity.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://midufefew.ru/strik?utm_term=how+to+write+a+reader+response+essay+examples PDF link annotation
- http://vifijes.22web.org/tu_mundo_2nd_edition_connect_answers.pdfIn PDF document text
- https://cdn.sqhk.co/gekakisoduvo/gLVhjdl/tipos_de_sujeito.pdfIn PDF document text
- http://nogurufegu.mygamesonline.org/aurelio_mejia_libros.pdfIn PDF document text
- http://xopiredat.22web.org/20_frases_de_el_amor_en_los_tiempos_del_colera.pdfIn PDF document text
- https://cdn.sqhk.co/fuwifemi/hgegjTl/how_do_you_make_icing_for_cake_decorating.pdfIn PDF document text
- http://degakak.sportsontheweb.net/70067625240.pdfIn PDF document text
- https://cdn.sqhk.co/tukawezezo/gAxkhhb/george_strait_christmas_songs_youtube.pdfIn PDF document text
- https://boxijobanopuvob.weebly.com/uploads/1/3/0/7/130739783/gomigimimu.pdfIn PDF document text
- http://fulukegoror.getenjoyment.net/curso_de_violo_popular.pdfIn PDF document text
- https://cdn.sqhk.co/sonometa/OOOhhhb/jakixamuw.pdfIn PDF document text
- https://tuzejaved.weebly.com/uploads/1/3/3/9/133997948/tobavujefi_gibariperowinen_dojapotowelejet.pdfIn PDF document text
- https://gikositaga.weebly.com/uploads/1/3/4/7/134773380/xidepinuwesimem-jipaku-marezeribajo-domorejasanobed.pdfIn PDF document text
- https://cdn.sqhk.co/xopuxuvop/wkEiahh/15328739797.pdfIn PDF document text
- https://cdn.sqhk.co/nosuterib/fqgj5wZ/play_city_builder_games_online.pdfIn PDF document text
- https://xesamubi.weebly.com/uploads/1/3/4/0/134095888/lubeduzima.pdfIn PDF document text
- https://cdn.sqhk.co/xisalaximel/xbMgdgi/acrylic_mirror_sheet_cost.pdfIn PDF document text
- https://sanepawoja.weebly.com/uploads/1/3/4/5/134579143/1274768.pdfIn PDF document text
- http://pakirekugep.scienceontheweb.net/19759375540.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://gevejonitu.onlinewebshop.net/dobebigamibaretug.pdfIn PDF document text
- https://8767aa75-4bd5-48c0-94ca-24e983238001.filesusr.com/ugd/debdc1_fe6b58bd37a34d17924c56e0e354b697.pdf?index=trueIn PDF document text
- https://2ed821ec-8078-4e74-b11b-c5cec6a88262.filesusr.com/ugd/65e777_38db3ebe9e1840eba90aae4f05a9c572.pdf?index=trueIn PDF document text
- https://0b21792c-a699-4cf4-8833-5910c6ad58af.filesusr.com/ugd/b0b521_2998ee84ccb148ae8985dcd911f7c78c.pdf?index=trueIn PDF document text
- https://2dcb0092-dd22-4cef-90c1-8c398f802bb7.filesusr.com/ugd/ff3115_ff656779091143e1a205fd60edde8823.pdf?index=trueIn PDF document text
- https://ca39a19f-16f9-469f-ab0b-65ec0463b8d0.filesusr.com/ugd/cc9b97_39e3df84faff41778b3fc5606600138c.pdf?index=trueIn PDF document text
- http://temefolix.epizy.com/12239979170.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00011da5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11DA5 | 5328 bytes |
SHA-256: 18feaa6931083f8aad6b6acd95c8827766312060fbccfb58ca3a7ff7a8978a3c |
|||
font_01_sfnt_off00012fc3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12FC3 | 10960 bytes |
SHA-256: 71be70410cfa43b0b29151957d559e84ef7945cdc7254c4a3ad2acb76cf5f02a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.