MALICIOUS
62
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of external links, many of which are SEO-optimized and point to PDF files on various domains. This technique is often used to distribute malicious content or redirect users to phishing sites. The presence of a link farm heuristic strongly suggests this is the primary malicious function. No scripts were extracted from this sample.
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://adsl-63-204-18-43.benefitplans.org/uploads/1/3/0/2/130288643/130288643.html#autoimmune+hepatitis+aasld+guidelines+2017
- http://www.bluesteelradio.com/uploads/1/3/0/6/130604025/6700506.pdf
- http://www.voiceoveranna.com/uploads/1/3/0/5/130539114/3276452.pdf
- http://ecotherapyspirituallounge.com/uploads/1/3/0/3/130380037/susibigoruvesumigi.pdf
- http://www.newlifedestination.com/uploads/1/3/0/9/130969991/2547349.pdf
- http://www.richmondcoworking.com/uploads/1/3/0/6/130639559/4273001.pdf
- http://neuface.net/uploads/1/3/0/2/130271045/fobejasepuwabovotemi.pdf
- http://www.rachelunbound.com/uploads/1/3/0/5/130544826/1699312.pdf
- http://homeintergration.com/uploads/1/3/0/9/130969658/eb73c53f35.pdf
- http://josephina.ballerina.com/uploads/1/3/0/5/130539059/dexenosidavuvinuvuw.pdf
- http://www.dellxl.org/uploads/1/3/0/4/130483354/fa322a.pdf
- http://sanjosedelosreynoso.com/uploads/1/3/0/2/130272242/4208756.pdf
- http://djsacademy.com/uploads/1/3/0/6/130640072/xakivabovazojubon.pdf
- http://gabrielkane.com/uploads/1/3/0/8/130813818/4668728.pdf
- http://optimusbusiness.net/uploads/1/3/0/7/130776687/7f7e0242a4af8.pdf
- http://shop.missabellahousekeeping.com/uploads/1/3/0/2/130287930/dumesezema_lukitabivifun_razuzorod.pdf
- http://www.osborgoflove.com/uploads/1/3/0/2/130287269/301bf73b30.pdf
- http://www.fdceducatorsnsw.com/uploads/1/3/0/2/130272973/rikonarinofezed.pdf
- http://indigorealms.com/uploads/1/3/0/6/130639183/d9dd99d010.pdf
- http://naturesedge-fl.org/uploads/1/3/0/5/130540604/0961d3a5d.pdf
- http://mta-sts.mail2.hauntedhousetour.com/uploads/1/3/0/3/130379431/galatedozodezij-wekibed-nibeliv.pdf
- http://anastasiaosho.com/uploads/1/3/0/6/130639842/zutelitonaduxod.pdf
- http://georgwebbtogo.com/uploads/1/3/0/6/130620961/2cf4642d.pdf
- http://steveslawnmowersales.com/uploads/1/3/0/3/130313037/667dae955ffa.pdf
- http://grovetennislessons.com/uploads/1/3/0/5/130550800/pejoli.pdf
- http://palletwrapz.net/uploads/1/3/0/4/130494636/magopewinof.pdf
- http://steveslawnmowersales.com/uploads/1/3/0/3/130313037/667dae955f
- https://doi.org/10.1002/hep.31065
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00009983.binc568828af4764a1920f8a472a096c083ad3f30976752f902a5b046375e0350fc |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9983 | 10284 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.