MALICIOUS
66
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains an embedded URL that redirects to a suspicious domain, likely as part of a phishing or scam campaign. The ML classifier strongly indicated maliciousness, and the PDF_SEO_DISPOSABLE_LINK_FARM heuristic suggests the document is part of a link farm designed to host malicious content. No scripts were extracted, but the embedded URL is the primary indicator of malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9984
Heuristics 4
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://mezovuduw.ru/wix?keyword=tropical+rainforest+landscapes+in+the+world PDF link annotation
- https://static.s123-cdn-static.com/uploads/4494674/normal_5ff90cd9a0112.pdfIn PDF document text
- http://pedagodogiko.getenjoyment.net/stihl_ms_180_16_in._31.9_cc_gas_chainsaw_reviews.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4454684/normal_6044dc7656c20.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4376086/normal_6028e7f1a6b2a.pdfIn PDF document text
- http://rakadan.sportsontheweb.net/viwibiladodijo.pdfIn PDF document text
- http://pomirkapa.site/offline_videos_youtube_not_workingpacfl.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4488130/normal_604af23b58b4a.pdfIn PDF document text
- http://rolopigabetitu.scienceontheweb.net/toefl_model_question_paper.pdfIn PDF document text
- http://gamukanemafutu.mywebcommunity.org/88155194763.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4385207/normal_5fffaced836a3.pdfIn PDF document text
- http://canlisohbetim.net/reactants_are_what_goes_into_the_reaction_what_are_the_two_reactants_needed_for_respiration_to_occur27wag.pdfIn PDF document text
- http://lipazegeboludep.sportsontheweb.net/votililapafikasivul.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://53002a68-e35f-4167-ac88-1ab9777d7e72.filesusr.com/ugd/f5bc2a_cfba0f28ad30453c99996cad19b01ac9.pdf?index=trueIn PDF document text
- https://200c4c3d-185b-4246-b99f-f40cd7065c99.filesusr.com/ugd/3ed902_26355e5ba246401cb2e3342cd4f6bee8.pdf?index=trueIn PDF document text
- https://7fd672c9-0ac8-42d3-9d3c-9ebb2fbea2b4.filesusr.com/ugd/92785a_67fb1f98805e4243800b0999308370c0.pdf?index=trueIn PDF document text
- https://168d2a81-f750-40c6-a653-3787650f980d.filesusr.com/ugd/3bcfef_92b24c9607ba4811acafb1bd6767cfb0.pdf?index=trueIn PDF document text
- https://3a7b682b-4b85-4b21-836a-a34929c8735b.filesusr.com/ugd/0cd3a8_d3b18e2c0d59490185a37f4314b82998.pdf?index=trueIn PDF document text
- https://4cd5a77a-be8d-44ba-8952-4177873115c4.filesusr.com/ugd/930050_2a51b06ca06a4ac89a5eee2e2b9fc071.pdf?index=trueIn PDF document text
- https://83d7d1d1-3661-4158-a2cc-78aa4aa39d08.filesusr.com/ugd/163759_1d96f022b1684c3b8b9fce2cd81da424.pdf?index=trueIn PDF document text
- https://a9f3490c-def6-45ea-9957-aefa341d54bd.filesusr.com/ugd/84b587_a63ebe4f00564da987ee4c4d850d7334.pdf?index=trueIn PDF document text
- https://ad323f3e-245e-4e3c-8b16-de91fefec063.filesusr.com/ugd/5ea691_f8b8a967028146b587633bc11ed1b6f4.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00024f3c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x24F3C | 5284 bytes |
SHA-256: 860e9fcacc8a5067ba7417da5ef4381e3c9d787d956ab2de13c28c2d85a810a7 |
|||
font_01_sfnt_off0002613b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2613B | 15948 bytes |
SHA-256: a7e9255211bcaae3f366d5a9b5f187e1593ac2af0f585b1d4816065ee75276e7 |
|||
font_02_sfnt_off00028fee.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x28FEE | 16088 bytes |
SHA-256: 44ac041feb7ffcc486e31f6c6b08974945921949ad81072bd535323626a5d03d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.