MALICIOUS
166
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document contains a large number of external links, many hosted on disposable domains, suggesting a link farm or redirection scheme. The document body contains a query about game passwords, which is likely a lure to encourage clicks on the embedded URLs. The presence of a password archive lure heuristic indicates that the document may be intended to trick users into downloading a password-protected archive, which could contain a malicious payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pixomot.ru/pbw?utm_term=what+are+the+passwords+for+team+kirby+clash+deluxe PDF link annotation
- https://poxotedodesogin.weebly.com/uploads/1/3/4/3/134305686/bituxiw-mogagizefikuxu-xetovopalumig-jaxosopadadafan.pdfIn PDF document text
- https://vudonifudiw.weebly.com/uploads/1/3/2/7/132741109/3768368.pdfIn PDF document text
- https://kunugamonigosa.weebly.com/uploads/1/3/1/8/131871761/8166746.pdfIn PDF document text
- https://kobalogowitat.weebly.com/uploads/1/3/0/7/130776452/3790009.pdfIn PDF document text
- https://dutumujupag.weebly.com/uploads/1/3/1/3/131383630/81dccd739.pdfIn PDF document text
- https://nijusalelazi.weebly.com/uploads/1/3/4/8/134875584/1192831.pdfIn PDF document text
- https://kesupegujofoju.weebly.com/uploads/1/3/5/3/135388852/dudevax-turawiruloza-gaxorivadofax-fotafolaxole.pdfIn PDF document text
- https://redulexaxoxega.weebly.com/uploads/1/3/0/8/130874010/mifanifisepom_gewabezixum_rovopapuximaxi.pdfIn PDF document text
- https://zoxopabetil.weebly.com/uploads/1/3/1/1/131163737/13147233a1c0df2.pdfIn PDF document text
- https://wovikuzejujitij.weebly.com/uploads/1/3/4/5/134506660/2f6f0.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4454984/normal_5ff8076b6e287.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4467560/normal_602f4c2fa4b69.pdfIn PDF document text
- https://kirenokasanav.weebly.com/uploads/1/3/4/4/134445236/xidatopumefuko-gigabuge.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://jabodawo.pbworks.com/f/dd_5e_baldurs_gate_descent_into_avernus_free.pdfIn PDF document text
- http://niwomif.pbworks.com/w/file/fetch/144421254/cease_and_desist_letter_slander_texas.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7000e3c9-fbe9-4756-9699-b52551bb873b/59651570065.pdfIn PDF document text
- http://pefagisunel.pbworks.com/f/70717340734.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/44f47de0-d765-4ca5-96bd-1412fbd03004/pegatopedigovomupobojexiz.pdfIn PDF document text
- http://ziludezubeju.pbworks.com/w/file/fetch/144462408/13646211376.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4fd7ab9b-40dd-45c4-a969-2b70c5ae04a5/how_to_study_network_security.pdfIn PDF document text
- http://zolunegoli.pbworks.com/w/file/fetch/144615897/bukedasewukafewofutoza.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f961.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF961 | 38284 bytes |
SHA-256: 17eff7a41c6ec19c5febef29a67c6aae30d0d8fadee4a7e93c21468e95035281 |
|||
font_01_sfnt_off00016a1d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16A1D | 5872 bytes |
SHA-256: e6c4e3622377b42f963ad90511339563e36c97b6f81ff3a56aa35769202574d4 |
|||
font_02_sfnt_off00017e17.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x17E17 | 11252 bytes |
SHA-256: a68055b1fb2a85da7b6cf6309ceb1e98a9e536ef16c24a0ab223ddfdeb2e69c0 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.