MALICIOUS
62
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious File
This PDF document employs a link farm technique, embedding numerous external links to other PDF files. The document body text, though corrupted, suggests a lure related to 'Sql server query pdf free download'. The primary heuristic indicates a mass of external PDF links generated for SEO purposes, pointing to a malicious distribution strategy. The embedded URLs are likely used to redirect users to further malicious content or phishing sites.
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://wca-stl.org/uploads/1/3/0/3/130323214/130323214.html#sql+server+query+pdf+free+download
- http://blakedroesch.com/uploads/1/3/0/7/130740232/3120036.pdf
- http://zeladvisorygroup.net/uploads/1/3/0/6/130640024/simepurilix_vamamow_jomuzajukubusi.pdf
- http://74-123-72-115.mgwnet.com/uploads/1/3/0/7/130775046/9901679.pdf
- http://mail2.maxims.sk/uploads/1/3/0/4/130489228/8823007.pdf
- http://kylinelsonteaching.com/uploads/1/3/0/5/130589444/3759726.pdf
- http://wedigllc.com/uploads/1/3/0/7/130739583/wurolugumi-jofogaworu-gepozipakegud.pdf
- http://garagedoorsuffolk.com/uploads/1/3/0/2/130291702/zaxenoz.pdf
- http://blazoncustoms.com/uploads/1/3/0/5/130588214/47058.pdf
- http://pccpnetwork.nhs.uk/uploads/1/3/0/5/130540186/edd2bbbdf.pdf
- http://www.cloutvibez.com/uploads/1/3/0/9/130969888/nibobokod.pdf
- http://loxelybeauty360.org/uploads/1/3/0/6/130604770/f9bbe6.pdf
- http://feministbookclub.org/uploads/1/3/0/5/130547969/6761172.pdf
- http://craxncrevices.com/uploads/1/3/0/3/130323485/dufozunusizifu_sololirun_ruxeriw.pdf
- http://mycyberphile.com/uploads/1/3/0/6/130604874/zomenokiw-mebeb-zesim.pdf
- http://mx.exponentialgoverning.com/uploads/1/3/0/5/130540420/rivod.pdf
- http://aprendizajeactivobrumiel.com/uploads/1/3/0/5/130540897/8171961.pdf
- http://totland-creative.com/uploads/1/3/0/4/130476276/ab000e.pdf
- http://www.st-john-baptist-church.com/uploads/1/3/0/7/130739020/wawazumojuvex.pdf
- http://thriftstorehemet.com/uploads/1/3/0/3/130323666/1748483.pdf
- http://birddelaney.com/uploads/1/3/0/3/130323407/016e71.pdf
- http://food.work/uploads/1/3/0/3/130313429/zujepomanewaxetaribe.pdf
- http://cafformation.org/uploads/1/3/0/8/130874409/8911951.pdf
- http://frenyella.com/uploads/1/3/0/3/130313741/zofovogu.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000776b.binc70eb1223405fb6fe25d521e95caf6934dd412dfcb0260106034a56f8bd8d4d9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x776B | 8660 bytes |
font_01_sfnt_off00009886.binfafefca58569ab71c98438c913b939156ad2bf3ace198f4deac40d55ed74543d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9886 | 1844 bytes |
font_02_sfnt_off0000a195.binbb7f3a77f7833b39fe6b0cf08265a5ad0460cb4bda91382e6c877c0db3ce514d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA195 | 16164 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.