MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was identified as malicious by an ML classifier. It contains a large number of external links, many hosted on disposable domains, suggesting a link farm or SEO spam operation. One of the embedded URIs, 'https://oniceh.ru/pbw?utm_term=how+to+use+the+milton+dummy+steriliser', is likely part of this scheme. No scripts were extracted, but the PDF structure and numerous external links indicate a malicious intent to redirect users to potentially harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://oniceh.ru/pbw?utm_term=how+to+use+the+milton+dummy+steriliser PDF link annotation
- https://xulasimij.weebly.com/uploads/1/3/2/8/132814518/472608f7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374536/normal_60482b3d35a42.pdfIn PDF document text
- https://rizomoxus.weebly.com/uploads/1/3/4/5/134589692/aadd79c6d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4464524/normal_6043867aa9588.pdfIn PDF document text
- https://lerorenoj.weebly.com/uploads/1/3/5/3/135390996/niladajira_namelubafemes_zixadiwu.pdfIn PDF document text
- https://nitowapesapu.weebly.com/uploads/1/3/4/4/134442046/45d5f69.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4471706/normal_60004d4d28b02.pdfIn PDF document text
- https://zojovotonoturur.weebly.com/uploads/1/3/5/3/135348007/kuvixape_savesukexolu_kipomorarekosad.pdfIn PDF document text
- https://fejavuwuvumago.weebly.com/uploads/1/3/0/8/130874007/128101.pdfIn PDF document text
- https://luralaxigagu.weebly.com/uploads/1/3/4/8/134868525/24957a57.pdfIn PDF document text
- https://penomagara.weebly.com/uploads/1/3/2/6/132695387/d9c52a63.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4385437/normal_60218b509c289.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4454677/normal_60523be5481bd.pdfIn PDF document text
- https://vepegusekukoj.weebly.com/uploads/1/3/4/4/134470637/mejavirabux-peruxirer-banaxazur.pdfIn PDF document text
- https://vurineju.weebly.com/uploads/1/3/2/7/132741272/xopelinejuxozes-xobikurawonu-didut.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://zufogopojut.pbworks.com/f/toyota_techstream_14_crack.pdfIn PDF document text
- http://jolowajuwijo.pbworks.com/f/radio_shack_metal_detector_63-3005.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/09ac3cdf-0d3b-4ed6-a5c1-671d3020d178/didulabobigewof.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cbf7ec5e-f609-45f5-be3e-9364f122fa6a/garmin_forerunner_620_price_australia.pdfIn PDF document text
- http://vajaxasave.pbworks.com/f/heather_piano_sheet_music_hard.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d17a1465-802c-4dfb-aa5b-1c278b8fcbcd/5683910504.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e73b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE73B | 5012 bytes |
SHA-256: 238ed8ee273a604436dad73a679673997bb6b2ed8495fbf44946aad0907c7f80 |
|||
font_01_sfnt_off0000f821.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF821 | 2532 bytes |
SHA-256: 394c240c8e5f3aadab1a709b55e5cbcc1b47e189138539bd4f0501eb3f16b16f |
|||
font_02_sfnt_off00010335.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10335 | 10608 bytes |
SHA-256: fe0504c29d2762cf38ed85fe63889b551aa35562790853a1aab7005286e54bab |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.