MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a large number of external links, many pointing to disposable hosting services, suggesting a link farm designed to drive traffic or distribute malicious content. The primary malicious URL identified is https://xezojetit.ru/strik?utm_term=samsung+galaxy+note+10+manual+network+selection, which is likely used for phishing or malware delivery. The ML classifier strongly flagged this PDF as malicious.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/strik?utm_term=samsung+galaxy+note+10+manual+network+selection PDF link annotation
- https://static.s123-cdn-static.com/uploads/4386349/normal_5fcc943246245.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4422147/normal_603937480b275.pdfIn PDF document text
- https://cdn.sqhk.co/tivanosox/dtjdXQw/answer_the_question_wrong_game.pdfIn PDF document text
- https://towizitubozabo.weebly.com/uploads/1/3/5/4/135400713/35643f3.pdfIn PDF document text
- https://cdn.sqhk.co/tubafejog/gjApdhi/best_90s_pop_stars.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4369907/normal_6006283f4e6d4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4484636/normal_60374440c8ec4.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4393345/normal_5ff1da1b8ea85.pdfIn PDF document text
- https://nesamakamaxo.weebly.com/uploads/1/3/1/6/131636712/rijasavojago.pdfIn PDF document text
- https://cdn.sqhk.co/kapokosop/RidYThd/how_to_download_groupme_app_on_iphone.pdfIn PDF document text
- https://wafiludelo.weebly.com/uploads/1/3/1/4/131437380/ririnunuzejekolugur.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4478703/normal_60388cc5c231a.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://f039f7e9-c7fa-441d-bf3d-2f0e35d6be10.filesusr.com/ugd/80685d_9a21a2ccd92343ee8166a08d429ed770.pdf?index=trueIn PDF document text
- https://aed022ca-8a9d-452d-9022-56a74a585a14.filesusr.com/ugd/4d548e_f9cd883900f74d50aa9f3f18d2afcd3f.pdf?index=trueIn PDF document text
- https://1a899ca6-11bf-4464-971e-4bf0b885e765.filesusr.com/ugd/4ac3ff_4ea8fcf5d274469786bde56270a31aac.pdf?index=trueIn PDF document text
- https://f38be386-5799-403b-9303-fb121113655a.filesusr.com/ugd/6f1aa7_4483254700e74f31805170edfd8b8c82.pdf?index=trueIn PDF document text
- https://18e99e0c-7034-4a8c-9069-267580a295b8.filesusr.com/ugd/b337f5_d8d605b625d74ef192066494026020e1.pdf?index=trueIn PDF document text
- https://07d68bf2-0661-47e2-9ffe-eae068a071af.filesusr.com/ugd/fef806_c3ba3a9e70f54560969c3801ea0e4fc3.pdf?index=trueIn PDF document text
- https://d56a38bf-d62e-453c-9b5b-5b2fe88aea46.filesusr.com/ugd/359e64_b59d82a5fdcf48b89b5fd72e58e1d318.pdf?index=trueIn PDF document text
- https://80f75f89-a1e3-4611-a0ef-7a704eb82da9.filesusr.com/ugd/0286dd_05f815593ad1498db7746c19572b473f.pdf?index=trueIn PDF document text
- https://a179b4bb-f9e1-4b0b-8685-f881d2afde68.filesusr.com/ugd/0fdb6d_c4d89d62e40746c6aab7649dbd1fbd9d.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f2cc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF2CC | 5740 bytes |
SHA-256: 37b59387fe2ccedc9d28653ebc90c3ff40c443b01cfda7bca8005658752a6c9a |
|||
font_01_sfnt_off00010665.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10665 | 11324 bytes |
SHA-256: 28ddd0e5246ff890288cf742b6697fe7a708cb562f921b2d3dfb24e9363381a5 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.