MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains a URL that matches one of the extracted external links. This suggests the primary purpose is to redirect users to a network of linked PDF documents hosted on various domains, likely for SEO spam or to distribute further malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://chrystalscreations.ca/uploads/1/3/0/5/130550948/130550948.html#formula+for+calculating+age+from+date+in+excel
- http://jewelleryforgentlemen.com/uploads/1/3/0/5/130543740/jodiliditotakatariv.pdf
- http://mx7.paterrealty.com/uploads/1/3/0/5/130588744/342051.pdf
- http://www.beau-makeup.com/uploads/1/3/1/0/131070904/mifedi.pdf
- http://www.televisetvnow.com/uploads/1/3/0/5/130543685/ziwimo_bozojogita.pdf
- http://theowlpublishing.com/uploads/1/3/0/5/130551155/renagegalu.pdf
- http://williambirtellrealestate.net/uploads/1/3/0/6/130620700/d43ec.pdf
- http://fields-auto.com/uploads/1/3/0/6/130605080/buzegujujeziberikemo.pdf
- http://reinventionqueen.com/uploads/1/3/0/4/130475936/6040837.pdf
- http://optimumonsite.com/uploads/1/3/0/6/130640003/femez-bukiwuj-sapixezokaw-xosigixewi.pdf
- http://home-cyber-protect.com/uploads/1/3/0/5/130551619/ca4b1d6c4e6.pdf
- http://www.londonrural.com/uploads/1/3/0/4/130475925/803406a0c0c6a2.pdf
- http://www.humandignitybook.com/uploads/1/3/0/7/130775589/pakexunasa.pdf
- http://www.annkellettghostwriting.com/uploads/1/3/0/4/130488483/sexonomaxiwa-dopejubigopexos-bixifozogu-padotef.pdf
- http://root8vegangf.com/uploads/1/3/0/9/130969021/2050189d.pdf
- http://netwerkpijnrevalidatie.com/uploads/1/3/0/3/130324050/fagapalib.pdf
- http://ohmyblingpaparazzijewelry.com/uploads/1/3/0/5/130546244/c786eb3b754.pdf
- http://animalclinicofchardon.preview.pethealthnetworkpro.com/uploads/1/3/0/6/130621516/7156924.pdf
- http://shiatsuthaiyogamassage.com/uploads/1/3/0/7/130739261/6790388.pdf
- http://hayleysusanphotography.com/uploads/1/3/0/6/130621191/2733255.pdf
- http://www.karibalexander.com/uploads/1/3/0/4/130476505/8599285.pdf
- http://walkerrootsfoundation.org/uploads/1/3/1/0/131070096/6180294.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000074d0.bin63d47de2fe82fa155a77a1254d23f1859a7ca25c06fff4861ed1bf9dfb09d923 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x74D0 | 8172 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.