MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. One of these links, https://xezojetit.ru/strik?utm_term=the+bee+tree+activities, is directly embedded in the document. The ML classifier also flagged this PDF as malicious with high confidence. While no scripts were explicitly extracted, the nature of the link farm suggests a potential for malicious redirection or content delivery.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/strik?utm_term=the+bee+tree+activities
- https://ratesikumetu.weebly.com/uploads/1/3/1/1/131163578/rijubebiwuxadunomeka.pdf
- https://rikekipodoze.weebly.com/uploads/1/3/0/7/130776447/dojolo.pdf
- http://numulul.mygamesonline.org/movie_maker_application_free_download_for_pc.pdf
- https://cdn.sqhk.co/pigevikuwi/aKaiiif/i_will_eat_it_all_upset_stomach.pdf
- https://bugajujifupub.weebly.com/uploads/1/3/4/8/134894919/jiluvasumiwaxaf.pdf
- http://jusojixanona.getenjoyment.net/8875245083.pdf
- https://ruzudewalaxuge.weebly.com/uploads/1/3/4/4/134497745/25fe7.pdf
- http://dorugatutaxovi.scienceontheweb.net/54773578287.pdf
- https://kagifinozadobet.weebly.com/uploads/1/3/4/9/134902547/gajidore.pdf
- http://pofuxubilet.sportsontheweb.net/tenavimuso.pdf
- https://cdn.sqhk.co/gawagunikuw/gjUpje7/lesesevagonunekofowudewi.pdf
- https://cdn.sqhk.co/nadovexum/bjatHid/80996163946.pdf
- https://peromukagitogim.weebly.com/uploads/1/3/1/3/131383820/a321d3d7409f285.pdf
- http://jesofoma.getenjoyment.net/boss_ve-20_vocal_processor_reviews.pdf
- https://dopatojibeforu.weebly.com/uploads/1/3/0/9/130969701/jasipipokorupibeb.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/nowokil/stay_hungry_1976_full_movie.pdf
- https://s3.amazonaws.com/xajowu/16826304363.pdf
- http://gunubepixel.epizy.com/limitless_template_angular.pdf
- https://s3.amazonaws.com/babetafaperaxov/5456444027.pdf
- http://suzazigomepaku.epizy.com/descargar_la_biblia_reina_valera_en_audio_gratis.pdf
- http://ranixivakogabon.epizy.com/makalah_dermatitis_atopik.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fce4.bined505021f1798d56c06d0d791d1589eb23c0252f8084c07e3b608099ebdaece8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFCE4 | 5004 bytes |
font_01_sfnt_off00010de0.bin9c7bb03104d97656ddac4e77546e5cf4e6cc0e546023ef64afce07829b860027 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10DE0 | 10496 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.