MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/123?utm_term=duragal+sheet+sizes PDF link annotation
- https://judurufag.weebly.com/uploads/1/3/4/6/134688768/9804456.pdfIn PDF document text
- https://zusonuxegaza.weebly.com/uploads/1/3/1/4/131437774/d14ec960675c7a0.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/a521db92-0f5d-482d-a4bc-7385cc3b8e0d/ministry_of_education_lesson_plan_template.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/26bbdaaf-fe68-4ac9-926b-688ed76935b7/are_all_continuous_functions_differentiable_justify.pdfIn PDF document text
- http://nosiravuga.pbworks.com/f/gijedezofifip.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b903498e-a7b6-4ee0-a5f4-41925c972b2c/descargar_pokemon_mundo_misterioso_exploradores_del_cielo_espaol_nds.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d6d00a7d-0ada-473e-be08-104e8de8669e/ge_universal_remote_codes_for_onn_dvd_player.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7405ca49-15c6-448f-9370-5467aa8c3459/witcher_series_books_timeline.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a2bc984e-4e14-4dad-9a27-a0a55687308f/que_es_un_taller_de_aprendizaje_segun_autores.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1f26173d-8be5-4349-bf0a-97a463f4725f/hambley_electrical_engineering_6th_edition.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f83a3261-5c80-4c98-ba62-b005d57cf2dc/85395763806.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/059a724a-9c9f-4b13-aadc-866cfc8421a0/salems_lot_vampire_movie.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/25d3914b-f017-4a9e-b561-cb1ba039e53e/44027425992.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/48080a01-dd3b-49bf-aa34-738d33e37a6e/does_wd_my_passport_ultra_work_with_mac.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/38914d86-0737-4f6b-8437-34db04f1dab7/the_philosophy_of_time_travel_by_roberta_sparrow.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/90b35ed1-87d7-4457-8564-4d7aa66d7825/how_to_restart_a_quadra_fire_pellet_stove.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/218d7ae0-6207-4a40-9b4f-8d7708c88ae8/29229170671.pdfIn PDF document text
- http://likanegi.pbworks.com/w/file/fetch/144513828/why_does_my_toilet_randomly_run_for_a_few_seconds.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/303451af-bc61-4827-ad5e-fd8bf73a0241/par_q_form_template_word_document.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/25bae5c0-c4bd-4db7-93ba-f555039271b1/arabic_grammar_book_in_bangla.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f408.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF408 | 4996 bytes |
SHA-256: 9966ed087f71e518678402eb83b57b33cbc2a92b480aa10fb7b919a3c27024fe |
|||
font_01_sfnt_off00010509.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10509 | 11632 bytes |
SHA-256: 7e5ea06482d2e8ffbe2244e7d251f72b474ca880fb33c339eee4f809196168ca |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.