MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF document contains a large number of embedded external links, disguised with a lure of an 'Appalachian trail guide book'. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of links pointing to various domains, suggesting a link farm or redirection scheme. The primary URL identified is http://darrenskitchen.com/uploads/1/3/1/4/131407110/131407110.html#appalachian+trail+guide+book, which likely serves as the initial entry point for the malicious activity.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://darrenskitchen.com/uploads/1/3/1/4/131407110/131407110.html#appalachian+trail+guide+book PDF link annotation
- http://rockportrenovation.com/uploads/1/3/0/6/130604935/zamozarewolekep_detapalizegi.pdfIn PDF document text
- http://a1derryhomedoctors.com/uploads/1/3/0/7/130776657/756811.pdfIn PDF document text
- http://matkaswim.com/uploads/1/3/0/2/130289313/4097552.pdfIn PDF document text
- http://toycity.com/uploads/1/3/1/0/131071114/15ed76215a.pdfIn PDF document text
- http://staylordesigns.com/uploads/1/3/0/6/130604133/jikobupefujonap_beziz.pdfIn PDF document text
- http://lsestore.com/uploads/1/3/0/5/130588246/fufagipira.pdfIn PDF document text
- http://portland-concrete.com/uploads/1/3/0/7/130776659/f086bd.pdfIn PDF document text
- http://getit.kim/uploads/1/3/0/9/130969654/3926411.pdfIn PDF document text
- http://isanybodylisteningtome.com/uploads/1/3/0/5/130547275/pilamikafojevoron.pdfIn PDF document text
- http://therustypinecone.com/uploads/1/3/0/9/130969488/2369497.pdfIn PDF document text
- http://thebarberrichard.com/uploads/1/3/0/3/130313123/6da1ee3.pdfIn PDF document text
- http://thepharmarketeer.com/uploads/1/3/0/6/130620363/311fa1.pdfIn PDF document text
- http://mermaidsransom.com/uploads/1/3/0/5/130550789/pilodavusomuzofu.pdfIn PDF document text
- http://spilledbeanscoffee.com/uploads/1/3/0/2/130287878/4757016dacd4.pdfIn PDF document text
- http://allanangelprinting.com/uploads/1/3/1/0/131070498/3214507.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
🗂 Part of campaign:
cyrcertification.com
3 samples
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00009184.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9184 | 7972 bytes |
SHA-256: b444fa1e324c095516d02cfc4629e3f098552c527bf010ca2d0646b228b74ba3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.