MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains a large number of external links, many hosted on disposable domains, suggesting a link farm intended to redirect users to malicious content. The primary malicious URL identified is https://jumiwimov.ru/strik, which is likely used for phishing or malware distribution. The ML classifier strongly indicated maliciousness, and the PDF structure with numerous links supports this assessment.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/strik?utm_term=philips+32pfl3506%252Ff7+remote+code PDF link annotation
- https://cdn.sqhk.co/mujexoxa/ibBhdh3/htc_weather_widget_for_windows_10.pdfIn PDF document text
- http://tipaxoj.66ghz.com/83767854217.pdfIn PDF document text
- https://cdn.sqhk.co/norowitidot/hBPXEKs/hot_shot_arcade_ball_table.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://vesuduw.epizy.com/18521369432.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1e556007-4003-4892-b674-5777b5a8c5e3/world_war_z_film_trailer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0b2cf499-fcd6-444b-9ef0-094c206d0400/48996552943.pdfIn PDF document text
- https://50fe66f1-00be-429c-ab6c-57a9f80d6ab9.filesusr.com/ugd/39cb9d_72d90e63245f4aec8c3bd54d1432ccbb.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/cd2eced6-7e21-448c-b4a4-24adce7b9a8c/waboru.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c0e735e8-2130-41ee-bbc7-7e48be7d0409/why_is_my_ego_battery_flashing_yellow.pdfIn PDF document text
- https://1ac5d900-0c69-4f12-8b1d-4e209472b8d2.filesusr.com/ugd/828753_098a6d45c27540dcb7b4804a56d96c71.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/534137d4-73ea-4017-bf50-0eefeab73fae/pathfinder_adventure_path_ratings.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3c524b9d-6739-4616-a50a-0f8ef9895aa8/56437403941.pdfIn PDF document text
- https://70848fb0-0fd0-490a-9360-2ffa38fc212c.filesusr.com/ugd/08e331_a5e245d800604dab8d40ad033635aa9d.pdf?index=trueIn PDF document text
- http://xiradev.rf.gd/sodotegug.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9a50186b-70c6-46d0-8dfe-9aa66165756f/giwosex.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ffa050c2-7dec-46cd-a06c-6f34d1b48ed1/how_to_test_reading_fluency_online.pdfIn PDF document text
- https://c83cbd6e-a134-4b49-ba12-49f24c654ad9.filesusr.com/ugd/904a8b_2fcb12c30a744b1da9d8037503ab51ac.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/0b5112ef-bb5c-4548-a74b-8804ef1a5496/jazzy_power_wheelchairs_prices.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6efb09a3-fb15-4d9b-9371-1273886d0a66/how_to_draw_a_simple_flying_dragon.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a2ac4cf2-7904-4449-98b1-0c0028ffd9f9/manual_for_bosch_dishwasher_silence_plus_44_dba.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010bad.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10BAD | 6020 bytes |
SHA-256: fb482f489e43bd415c480d63816e92ccde1ed589acf789c732381ed949b2f480 |
|||
font_01_sfnt_off0001201a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1201A | 10728 bytes |
SHA-256: 04a0894ed652dd470fa09e09912e2abbd9b9c89733e950653c99038475210445 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.