MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file exhibits characteristics of a link farm, with a large number of external links, many of which are to other PDF documents. The primary URL, https://laborke.ru/pbw, is associated with a search query for movie downloads, suggesting a lure to potentially malicious content. The ML classifier also flagged this PDF as malicious, reinforcing the suspicious nature of its content and structure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9562
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILEDThe cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://laborke.ru/pbw?utm_term=new+hollywood+full+movie+download+in+hindi+filmyzilla
- https://mokapojigum.weebly.com/uploads/1/3/4/6/134690111/tidekun.pdf
- https://cdn-cms.f-static.net/uploads/4468563/normal_60bc1da88a5f3.pdf
- https://cdn-cms.f-static.net/uploads/4492253/normal_604f4c9e9ccb6.pdf
- https://cdn-cms.f-static.net/uploads/4426815/normal_600fccc577524.pdf
- https://cdn-cms.f-static.net/uploads/4457838/normal_600a4a658cf5a.pdf
- https://cdn-cms.f-static.net/uploads/4465935/normal_605e105b8452b.pdf
- https://xevupuwikuguv.weebly.com/uploads/1/3/0/8/130814145/9565c197.pdf
- https://static.s123-cdn-static.com/uploads/4443588/normal_5ffe9adcc1523.pdf
- https://bamesejoporafuv.weebly.com/uploads/1/3/4/2/134265360/324300.pdf
- https://cdn-cms.f-static.net/uploads/4392193/normal_6036da1bc0954.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://ziriwuru.pbworks.com/f/nadra_e_sahulat_multan_cantt.pdf
- https://uploads.strikinglycdn.com/files/6846b965-ac3a-4db4-a855-ee0bbf485be0/zasipapiwive.pdf
- http://luwivaj.pbworks.com/w/file/fetch/144514590/list_of_non_manual_markers_in_asl.pdf
- http://bopidix.pbworks.com/f/barbie_peliculas_completas_en_espaol_latino_una_aventura_de_sirenas_1.pdf
- http://muxapoxowo.pbworks.com/w/file/fetch/144645201/plants_vs_zombies_2_music_jurassic_marsh.pdf
- https://uploads.strikinglycdn.com/files/bcdab2dc-744b-48ac-bc18-1eef45fd7ff4/performance_kpi_dashboard_excel_template_free_download.pdf
- http://jolowajuwijo.pbworks.com/w/file/fetch/144591867/z3x_box_pro_36.1_crack.pdf
- https://uploads.strikinglycdn.com/files/de462da1-7289-44e2-ba05-9f6c94052a22/download_design_home_mod_apk_android_1.pdf
- https://uploads.strikinglycdn.com/files/91ebf55b-1735-4006-84e3-e468a148f312/6538702937.pdf
- http://xojifot.pbworks.com/f/organization_theory_and_design_3rd_canadian_edition_free.pdf
- https://uploads.strikinglycdn.com/files/e3799663-22ee-4e5d-a771-4781b21c882b/99733669639.pdf
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e3cf.bin7ad9876d8eb5d047d81209af56d6ef1c0b379390d3c23a772dc5b901ebb2e357 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE3CF | 5148 bytes |
font_01_sfnt_off0000f559.binb8bb6844e17537e7b274aecca0da72d2e8b2e483a6103873be343a031ed1cf26 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF559 | 11000 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.