MALICIOUS
66
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous embedded URLs, many pointing to disposable domains, and is flagged by ML classifiers as malicious. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a high likelihood of the document being used to distribute malicious content or phish users by presenting a large number of links. The presence of 'utm_term' in a URL suggests tracking or redirection, common in phishing campaigns.
Machine Learning
- Nyx PDF Classifier malicious score 0.9982
Heuristics 4
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/strik?utm_term=basic+biochemistry+exam+questions PDF link annotation
- https://cdn-cms.f-static.net/uploads/4387581/normal_602e6faca9695.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4478137/normal_60299362adc4e.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4477139/normal_5ff6a8ce981a6.pdfIn PDF document text
- https://cdn.sqhk.co/monazaxumol/6Fjatgc/mejexomoxazini.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4409257/normal_5fdb932bad92a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4478950/normal_602c44bee4a0d.pdfIn PDF document text
- https://cdn.sqhk.co/masamiwe/jgetijt/holy_duck_sunderland.pdfIn PDF document text
- https://tinonerapize.weebly.com/uploads/1/3/5/3/135349756/1a891686a8d130.pdfIn PDF document text
- https://fowawuxubave.weebly.com/uploads/1/3/4/7/134759807/zavub_xititisazefoxif_vujovazuririv_rubezarede.pdfIn PDF document text
- https://cdn.sqhk.co/dokukavifig/9mihjek/pumerijamefajawufe.pdfIn PDF document text
- http://wigogaduxatinuv.iblogger.org/vilatawodebu.pdfIn PDF document text
- https://cdn.sqhk.co/bedipidis/P87hhDT/jiomeet_not_available_in_usa.pdfIn PDF document text
- https://wirolarem.weebly.com/uploads/1/3/1/6/131636642/9a013.pdfIn PDF document text
- http://nowofuguvinidaw.iblogger.org/amman_kummi_pattu_song.pdfIn PDF document text
- http://moradudipomibo.mypressonline.com/sap_business_process_management.pdfIn PDF document text
- https://tavebesu.weebly.com/uploads/1/3/1/3/131381332/jumofizepizekuz-revukenoxalulon.pdfIn PDF document text
- http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://zubixuguse.epizy.com/confluence_static_jira_report.pdfIn PDF document text
- http://tewegaza.epizy.com/lelepape.pdfIn PDF document text
- https://0ca3454e-05ac-49fc-8d00-644b1af7be3c.filesusr.com/ugd/8bf3fc_93fd054b589d41319ca18733bf489e16.pdf?index=trueIn PDF document text
- https://35ba851f-b8be-4af7-9f70-ac2b227e175a.filesusr.com/ugd/e3c460_28bc88e8628a4ebdb6296ea678e23340.pdf?index=trueIn PDF document text
- https://70745723-7f4a-4dc7-98be-95bdce43cd82.filesusr.com/ugd/67bae7_4322c942a25f499195dacbdf27b0c8e6.pdf?index=trueIn PDF document text
- https://9de673a2-3b8e-40eb-bbf5-c0ad8e71a3da.filesusr.com/ugd/bd5c68_06bbc9c8ff814842a2750646c74a0f41.pdf?index=trueIn PDF document text
- https://0ecef3a8-5193-4df1-8dcb-1b7dd0f2be2a.filesusr.com/ugd/e6092c_005b3729121d4dc8ab09e3ad6b895d74.pdf?index=trueIn PDF document text
- http://wibotej.epizy.com/buzibanomamikuxipesupuvo.pdfIn PDF document text
- http://zewadomi.myartsonline.com/regression_analysis_by_example_5th_edition_download.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00018412.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x18412 | 2988 bytes |
SHA-256: 507d5095653cb1d73ea84cdb489180aaa5bd95d7add5ee11c00d56e8a6e2af51 |
|||
font_01_sfnt_off00018e9e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x18E9E | 1772 bytes |
SHA-256: a1a124da5f32bfb7a174d115700096844f2c5ae02854133e6668d27994c0d4ca |
|||
font_02_sfnt_off0001975e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1975E | 5492 bytes |
SHA-256: e16c41379000f978ab5741523a301dfa253745a61bf3a096699cade39aaa0c7a |
|||
font_03_sfnt_off0001a9f0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1A9F0 | 12280 bytes |
SHA-256: f1a1942bf6b7e87c10d0c129eefad777ac360a5da789c8cde87dbe6c37628880 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.