MALICIOUS
92
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The embedded document body text, while partially corrupted, includes a URL that points to a collection of PDF files. This suggests the primary purpose is to redirect users to a link farm, likely for SEO manipulation or to serve as a distribution point for further malicious content. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://xocobean.com/uploads/1/3/0/2/130289746/130289746.html#prueba+de+hipotesis+estadistica+ejemplos+en+excel
- http://www.whalestowags.com/uploads/1/3/0/9/130969449/zexukiworosibawefa.pdf
- http://screenlo.com/uploads/1/3/0/5/130543588/9561761.pdf
- http://cheytownlady.com/uploads/1/3/0/2/130271243/tutapizugolajezupik.pdf
- http://naiobebrown.com/uploads/1/3/0/4/130483191/voxizap.pdf
- http://luxurydaytona.com/uploads/1/3/0/7/130775200/4078012.pdf
- http://a2zaccountants.org/uploads/1/3/0/5/130590436/tevejogudepurim-kizolu-xinemepapaj-dujisoxet.pdf
- http://annapolismontessori.net/uploads/1/3/0/6/130604026/b730676ad564f.pdf
- http://thefinalbow.com/uploads/1/3/0/7/130739112/polofet-zegudirewuliwuj-nixadisudonufu-mefikusa.pdf
- http://connectumarriageministry.com/uploads/1/3/0/6/130604220/bigoju.pdf
- http://ecofirewood.lt/uploads/1/3/0/5/130590279/tikinak.pdf
- http://mommasnow.com/uploads/1/3/0/2/130288510/7717092.pdf
- http://apexformulas.com/uploads/1/3/0/6/130604696/e3d7a8cf59.pdf
- http://arihantoart.com/uploads/1/3/0/4/130488265/3ca760f12b6775.pdf
- http://www.helpscottheal.com/uploads/1/3/0/4/130483869/9684316.pdf
- http://howlettandco.com/uploads/1/3/0/4/130476574/9e7f5daeb17a6.pdf
- http://spectrumlifecare.net/uploads/1/3/0/7/130739289/a11c0.pdf
- http://www.mythinkando.com/uploads/1/3/0/5/130539416/tinovofezutizisu.pdf
- http://newanday.host/uploads/1/3/0/6/130621282/pomijevoxu.pdf
- http://viraven.com/uploads/1/3/0/4/130476738/4844307.pdf
- http://www.creative-tech.ca/uploads/1/3/0/5/130539494/6001302.pdf
- http://midlandsdetailer.com/uploads/1/3/0/4/130476976/5205e6b.pdf
- http://ahacia.com/uploads/1/3/0/8/130813055/84b954a5d9.pdf
- http://scotiarootstours.com/uploads/1/3/0/2/130274097/e6dada132e0dc.pdf
- http://lindsayrosehealing.com/uploads/1/3/0/3/130379651/rugofowa-pojewepum-wifiwadepux-nalebapakudumuz.pdf
- http://lindsayrosehealing.com/uploads/1/3/0/3/130379651/rugofowa-pojewepum-wifiwadepux-
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000077fa.bind653bae1d331fce76012cd62f2202a191dc8e784da62fc9919bb4563409f7183 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x77FA | 8952 bytes |
font_01_sfnt_off0000966f.bin779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x966F | 16036 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.