MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://mezovuduw.ru/123?utm_term=eclipse+dark+theme PDF link annotation
- https://sikowegapewabi.weebly.com/uploads/1/3/5/9/135975971/fefupolijejanogamude.pdfIn PDF document text
- https://pixipemojawipe.weebly.com/uploads/1/3/4/4/134459682/c78a9967.pdfIn PDF document text
- http://checkmyscore.info/cromer_pier_fishing_reportrhi6l.pdfIn PDF document text
- http://vsspb.ru/el_arte_de_la_seduccion_robert_greene_audiolibro4ngcx.pdfIn PDF document text
- http://reweder.site/answer_to_what_s_up_in_spanishr1re7.pdfIn PDF document text
- http://mif-smeh.space/top_10_spoken_english_app_for_androiday7ds.pdfIn PDF document text
- https://revoninutilira.weebly.com/uploads/1/3/5/3/135338282/ganapur.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/5fc96d6e-a695-4ddf-8cae-de5e1e11b9c1/zuxuxowamuzanisovudamofo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2125f5ec-1523-4da4-9245-12a797e1f493/national_dolphin_rv_owners_manual.pdfIn PDF document text
- https://8ac5c8e1-9174-427d-95c2-90bebb9f105a.filesusr.com/ugd/44b221_112e66dd823c41dab7d6fc2f5bc0b108.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/820d908f-7006-43d9-9fd3-23e0e015a746/lajopabubaluriga.pdfIn PDF document text
- https://de99c131-68bf-4271-bcef-cda292486844.filesusr.com/ugd/f5892c_936c04a587114342b9f2c4b8ddd4dce5.pdf?index=trueIn PDF document text
- https://03df18d0-0a94-4077-8b44-1f3cf8b7c870.filesusr.com/ugd/23a6c3_75da7e67eed9465cb1afad081aba4257.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/5c03a3fd-33a0-4e9a-bfa9-7c673bb61a6c/81843814505.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/907253da-3442-48ee-873f-24d23a2d5ca9/luxigutedof.pdfIn PDF document text
- https://944456f3-75eb-4cd6-bbfd-656b3713ada1.filesusr.com/ugd/2c8d66_4b3e47d184654bffa76fd67ad031afe0.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1e503386-d2b4-46d6-b90c-94cb4d11a249/verudunubazosole.pdfIn PDF document text
- https://b9e1b105-38e0-4bbf-baad-90de1e2021e1.filesusr.com/ugd/432b07_9d28cab57c3140a8bd31859b0f835139.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/45a685c8-9de7-4ba9-bd52-e04c5f06765a/margin_of_safety_accounting_concept.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8d0b60e5-c800-4b7a-a140-89b6fccb236e/15917401655.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/30100d77-a2a8-481e-8400-23f62502b7a6/how_to_thread_needle_brother_sewing_machine.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bbdec38b-4963-4921-a5d1-7923d017cd6d/tutorial_de_sonar_platinum.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5f06c95c-09ab-4759-b28c-edc442929edd/90404890980.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f3b5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF3B5 | 5336 bytes |
SHA-256: 68c43dbbf6fbcdd2014e3afd4b521dac7e52269c7246392069626bca8cd56294 |
|||
font_01_sfnt_off000105a5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x105A5 | 1800 bytes |
SHA-256: daad3f347a4f42f432ee9983e619a7c063e36761dba5934b469418034847e28e |
|||
font_02_sfnt_off00010e33.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10E33 | 11316 bytes |
SHA-256: e938225c42e2ec6f77957d47249d67d987347407f738730257e0d28867832180 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.