MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a suspicious URL that appears to be part of an SEO link farm, a common tactic for distributing malicious content or phishing pages. The ML classifier strongly indicated maliciousness, and the presence of numerous external links, many of which are PDFs, further supports a malicious intent. No scripts were extracted, but the PDF structure itself is indicative of a lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/strik?utm_term=never+back+down+3+movie+download+480p
- https://cdn-cms.f-static.net/uploads/4366017/normal_606df6224ead7.pdf
- https://static.s123-cdn-static.com/uploads/4369486/normal_5ff34efea329d.pdf
- https://static.s123-cdn-static.com/uploads/4376612/normal_5fc5a0f3b5924.pdf
- https://sajosapisede.weebly.com/uploads/1/3/4/3/134344890/liwokogadikimaz-vexabalu.pdf
- https://static.s123-cdn-static.com/uploads/4444358/normal_5fcbb21b21e7e.pdf
- https://tigaguxekebopu.weebly.com/uploads/1/3/4/5/134592721/3043108.pdf
- https://cdn-cms.f-static.net/uploads/4383925/normal_60542d13bb166.pdf
- https://cdn-cms.f-static.net/uploads/4366398/normal_605a42fc40a23.pdf
- https://lenalavawin.weebly.com/uploads/1/3/4/7/134732275/bijopigo.pdf
- https://cdn-cms.f-static.net/uploads/4383689/normal_603369a5e007b.pdf
- https://denosuzasagi.weebly.com/uploads/1/3/2/7/132712615/0b5e93c01d25332.pdf
- https://cdn-cms.f-static.net/uploads/4382771/normal_5fe9230e771fe.pdf
- https://wokozizexufam.weebly.com/uploads/1/3/4/2/134234926/sifubonej_nuxowa.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/72cf5b17-2616-4a3c-9ae0-fdab05b3112f/apple_lightning_connector_to_digital_av_adapter.pdf
- https://uploads.strikinglycdn.com/files/e2ff6dc6-b3d9-4d35-8868-b5b645514ffc/98527085262.pdf
- https://uploads.strikinglycdn.com/files/5dd5341f-242e-4291-96d2-e8306637c76d/13707401009.pdf
- https://uploads.strikinglycdn.com/files/42dd16c0-8893-4ce3-ada2-d02e006dab63/chemistry_ionic_puzzle_piece_activity_answer_key.pdf
- https://uploads.strikinglycdn.com/files/249f251b-b7c7-4a4a-88da-5241bfc7fc48/share_market_holidays_august_2020_india.pdf
- https://uploads.strikinglycdn.com/files/68974483-0c08-4ea9-9f41-6ae8b5827bdb/what_natural_remedy_kills_toenail_fungus.pdf
- https://uploads.strikinglycdn.com/files/2973c11c-4de6-45f8-8ab8-f143f0bf8042/2017_ktm_rc_390_owners_manual.pdf
- https://uploads.strikinglycdn.com/files/f0668441-7ca1-4145-a3c4-12d11fffd6a7/sunukutebuz.pdf
- https://uploads.strikinglycdn.com/files/de8a2145-623c-4112-8bba-4d085aad7ee8/lofizajivumijimiveja.pdf
- https://uploads.strikinglycdn.com/files/22404996-25b6-4c2d-afa0-1101f2064e70/aiag_apqp_manual_4th_edition.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f3f2.bin4a7924528bee57e2c6720318e63b363bb72a19b8727bc1f8a85670f04b84ff3e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF3F2 | 5952 bytes |
font_01_sfnt_off00010843.bin8c965591172ffd7ce251d6dadea5b092cdbb7493dc203a362ed33f10b96018ee |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10843 | 10732 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.