MALICIOUS
66
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The ML classifier strongly indicated maliciousness, and the PDF contains numerous external URIs, many hosted on disposable domains, suggesting a link farm designed to redirect users. The presence of 'Android tv comprar media markt' in the document body, combined with the PDF_SEO_DISPOSABLE_LINK_FARM heuristic, indicates a lure to a potentially malicious website. No scripts were extracted, but the structure suggests a phishing or redirection attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9988
Heuristics 4
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/123?utm_term=android+tv+comprar+media+markt PDF link annotation
- https://cdn.sqhk.co/gabironero/idjgchj/one_button_soccer.pdfIn PDF document text
- https://cdn.sqhk.co/dikizumi/iqhbBTg/war_of_conquest_canada.pdfIn PDF document text
- http://eroganoficial.site/xiguvimelazanedemumuk1pdx6.pdfIn PDF document text
- http://closemaze.com/simon_ielts_video_freet90is.pdfIn PDF document text
- http://penafur.scienceontheweb.net/assam_university_result_2020.pdfIn PDF document text
- http://bcipreactivaperu.com/79764059912vg6lu.pdfIn PDF document text
- https://cdn.sqhk.co/tajugajobib/hinOkhg/crash_team_racing_ps4_trophies.pdfIn PDF document text
- https://cdn.sqhk.co/mavixuwaloz/fjaTTVk/jigomufozikefewewatewufan.pdfIn PDF document text
- http://topcreditmonitoring.info/879247760733tys.pdfIn PDF document text
- http://rozogididibusar.sportsontheweb.net/cunto_tiempo_puede_durar_un_zumbido_en_el_odo.pdfIn PDF document text
- http://naturaleone.space/27748398415nsiew.pdfIn PDF document text
- http://sawemawe.mywebcommunity.org/the_fall_guy_season_5.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://907864b8-ab38-4b43-b195-7646ee37c451.filesusr.com/ugd/c4b402_1febea59a3724db181f13833c0f6ca73.pdf?index=trueIn PDF document text
- http://serekosesera.rf.gd/9084168991.pdfIn PDF document text
- http://kuxomexepus.epizy.com/children_s_halloween_mask_templates.pdfIn PDF document text
- http://zitulogakapede.myartsonline.com/73018653918.pdfIn PDF document text
- http://wozubegozib.rf.gd/how_much_water_do_you_add_to_avent_microwave_steriliser.pdfIn PDF document text
- https://4bbf79d8-97e4-42de-9a75-948158c354f0.filesusr.com/ugd/52f5d3_dcd41530a7a245dcab9d1dbf1971487e.pdf?index=trueIn PDF document text
- http://puribisipup.atwebpages.com/mijami.pdfIn PDF document text
- https://1a2149e7-ca7f-4e7c-a584-0e483de6f3af.filesusr.com/ugd/9219f8_dc8b38f11c674b9aa754b5638a028f3e.pdf?index=trueIn PDF document text
- https://3bdad275-8828-414d-9063-9532e035d791.filesusr.com/ugd/c67d0c_2d70c75d578b4beda70e8013382e3d7f.pdf?index=trueIn PDF document text
- https://59e5a08b-0d8d-455f-a3a7-35a3b781ab3e.filesusr.com/ugd/784815_0b1c13742cf6401a8e97ee543f581e78.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f085.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF085 | 6744 bytes |
SHA-256: b29f9350a720d2da9dc50567d08c4a82684db1fcb28a47e3a5788345b392d808 |
|||
font_01_sfnt_off0001016a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1016A | 4912 bytes |
SHA-256: ebb7e42f39845d6cbab29f977972ee7d2970ffeb3f663fd27f41ca69d8d1f063 |
|||
font_02_sfnt_off000111f8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x111F8 | 1840 bytes |
SHA-256: 39fb62d24bd54d4cff90e75353e2f51bc194a482803ce5872e41bed0e07153dd |
|||
font_03_sfnt_off00011af3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11AF3 | 12572 bytes |
SHA-256: ff57278e27578069b8804208ff93c5e79968846f5e4640d328c62ad15b458bbb |
|||
font_04_sfnt_off000143e8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x143E8 | 4324 bytes |
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.