MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains embedded links that redirect to a known malicious domain, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The ML_NYX_PDF_MALICIOUS heuristic also flagged the file with high confidence. The document body, though heavily obfuscated, contains text related to a 'guide to evidence-based physical therapist practice pdf', suggesting a lure to disguise the malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/wix?keyword=guide+to+evidence-based+physical+therapist+practice+pdf In PDF document text
- https://cdn.sqhk.co/kosojilufut/h3wjiib/zombie_derby_mod_apk.pdfIn PDF document text
- https://cdn.sqhk.co/bexefoboxevi/bvffxad/mr_herobrine_s_mansion.pdfIn PDF document text
- https://cdn.sqhk.co/zevukodixu/ieohevf/stair_runner_home_depot_canada.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4391319/normal_6027bb72a7bd8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4389085/normal_60474b2455289.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4427793/normal_602c478ce5c87.pdfIn PDF document text
- https://cdn.sqhk.co/rigizisojix/ajcgiie/24559309884.pdfIn PDF document text
- https://cdn.sqhk.co/zisubiziwu/bmgdFad/1377096870.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4460232/normal_5fde9d3732093.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/lupuvogotog/the_dictionary_of_symbols.pdfIn PDF document text
- https://73856814-13bb-4d44-aeaf-752cce6ba6bd.filesusr.com/ugd/a0d21a_d5d3e578581b484287a26b9719ded7cb.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/tadevewuju/budget_forms.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e4b866db-755d-4315-a7eb-0f4cdfbf146d/2001_toyota_sequoia_jbl_radio_wiring_diagram.pdfIn PDF document text
- https://88211235-bf86-4d40-a6ec-a052db2f682e.filesusr.com/ugd/94e5ef_4e6e244864a14af9bf690a6b840848e4.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/f82270e8-4086-4c0e-a18b-8bdb7d667a87/nurutizekamimi.pdfIn PDF document text
- https://s3.amazonaws.com/zozofufulolig/vexazedamixugitafetef.pdfIn PDF document text
- https://5e9c932d-19a8-4d5a-a970-d4bc0bcb832b.filesusr.com/ugd/bae0a0_5b7cf53357fd4e798d09fe317e4221ad.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/8f153427-8369-4881-834b-4c4b81a48c87/51243688359.pdfIn PDF document text
- https://40e214c1-1950-44e8-a195-e2c6eeb23253.filesusr.com/ugd/a517f4_1ce8a3afca0e497884cc9774542eb4e6.pdf?index=trueIn PDF document text
- https://9539e3d7-93ad-434a-85ac-22bd9bdb82bb.filesusr.com/ugd/df7b34_dd99aa7f98214d48991898ca823d1f99.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/360e6e4b-c37f-414e-8ec9-6d1821ea6a00/39507016259.pdfIn PDF document text
- https://ce2645ba-e89a-43d5-afff-5c0150757291.filesusr.com/ugd/c63dba_1153ebf428fb46ee9eb65337161d4282.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/101ffabb-f38f-4ff3-831c-976a22c37cb5/bubutuni.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000edfd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEDFD | 5608 bytes |
SHA-256: 2ad10cfab50a07d92a2780e7d9cd036c77ea5a8103ebb1f027fa431685c6ad92 |
|||
font_01_sfnt_off00010119.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10119 | 10340 bytes |
SHA-256: 2118ec105fb32bb2cb04547346fddb5dc47582ac5a2d4c6120491d6090309395 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.