MALICIOUS
92
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious File
The PDF file exhibits characteristics of a link farm, containing numerous external links to other PDF documents hosted on various domains. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies this pattern, suggesting a malicious intent to distribute traffic or host further malicious content. The ML classifier also strongly indicates maliciousness. No scripts were extracted, but the extensive list of external URLs points to a delivery or redirection mechanism.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://wildwonderfulyou.com/uploads/1/3/0/2/130289703/130289703.html#todos+los+cuadril%C3%A1teros+son+paralelogramos
- http://830-glass.com/uploads/1/3/1/0/131069838/tuxasivexufa.pdf
- http://martialartskirkland.com/uploads/1/3/0/5/130588370/xifapekog_lelupobijibet_vuvuzokurevig_zopupetejelid.pdf
- http://www.stittsvillemusicacademy.com/uploads/1/3/0/4/130435787/nitomuz_befudixojajude_zurizope.pdf
- http://deletecoinbase.com/uploads/1/3/0/3/130323167/125897.pdf
- http://www.briard.zlotaelita.pl/uploads/1/3/0/3/130324278/lepumaxetonoludu.pdf
- http://muirheads.shop/uploads/1/3/0/8/130873915/nakefiwus_pefitukadusobe.pdf
- http://mta-sts.tvtresdiasid.org/uploads/1/3/0/6/130604635/vojezovidinikaf.pdf
- http://yourphotoball.com/uploads/1/3/0/5/130551053/582c3118eb0.pdf
- http://www.catalpagroup.com.au/uploads/1/3/0/4/130436431/vawifo.pdf
- http://nu-wellnesstoday.com/uploads/1/3/0/6/130605462/kevimavixux.pdf
- http://hostmaster.offcina.pt/uploads/1/3/0/6/130604706/db69e924be8.pdf
- http://paraviontheory.com/uploads/1/3/0/7/130740374/nuruxodonoja.pdf
- http://wabbitphotography.com/uploads/1/3/0/6/130605497/9113f.pdf
- http://alisonzagona.com/uploads/1/3/0/6/130639517/zavifekixusirikono.pdf
- http://carwashpumprepair.com/uploads/1/3/0/7/130776529/7499378.pdf
- http://preapprovalcredit.com/uploads/1/3/0/5/130547142/zemapiwede-xonipejizax-mewulefatadifo-kisofoxogadas.pdf
- http://msr2mng.com/uploads/1/3/0/6/130605030/3617243.pdf
- http://mx.shoptaradise.com/uploads/1/3/0/7/130740368/tokupofudo_mumaba_xedezezo.pdf
- http://movingtosantodomingo.com/uploads/1/3/0/8/130873782/zuzowusodetenipunilu.pdf
- http://hostmaster.fabricwrappingco.com/uploads/1/3/0/8/130873840/6cc835a2c2.pdf
- http://mx.shoptaradise.com/uploads
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00008550.binf15b5dc60b3b2487320491d26fc37520839863664c20277b445416b00d4991be |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8550 | 9812 bytes |
font_01_sfnt_off0000a855.bine24ce10c9c429baf5f23c53a13b536e731edf31769cec2334b21ccdb63354fb5 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA855 | 3908 bytes |
font_02_sfnt_off0000b5db.binf8be899b344eead765f904feb4dfacd9153b4711e3f0f0109e6d5067fe322189 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB5DB | 16400 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.