MALICIOUS
62
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on different domains, suggesting a link farm or SEO poisoning tactic. The document body contains garbled text and a reference to 'specific heat capacity of methanol', which appears to be a lure to disguise the malicious intent. No scripts were extracted from this sample.
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://newperspectivemedical.com/uploads/1/3/0/7/130739452/130739452.html#specific+heat+capacity+of+methanol+in+kj%2Fkg+c
- http://mta-sts.mail.coaptcontrol.com/uploads/1/3/0/6/130639854/lubite-zugemi.pdf
- http://pelledolce-scottsdale.com/uploads/1/3/0/5/130543868/8afe1701.pdf
- http://urzedo.com/uploads/1/3/0/6/130604264/lekigozawofeju.pdf
- http://mylabeau.com/uploads/1/3/0/6/130621818/fesifurizipuki.pdf
- http://myupcycled.com/uploads/1/3/0/5/130550980/4339608.pdf
- http://sober-housing.net/uploads/1/3/0/6/130604458/7905467.pdf
- http://mytempdomain.club/uploads/1/3/0/3/130313005/0a621a35.pdf
- http://itsmrjack.com/uploads/1/3/0/5/130543488/turodujov.pdf
- http://bizania.com/uploads/1/3/0/5/130550967/9308973.pdf
- http://moody.af/uploads/1/3/0/2/130289632/4ca97fa.pdf
- http://boylies.org/uploads/1/3/0/4/130483348/lesakapawetozot.pdf
- http://www.polarityzug.ch/uploads/1/3/0/4/130483509/4612023.pdf
- http://www.phoenixrisinghealthcoaching.net/uploads/1/3/0/5/130588270/fba124d23.pdf
- http://savourit.ca/uploads/1/3/0/5/130590384/zofib.pdf
- http://kheeterwgu.com/uploads/1/3/0/8/130814190/1496185b3f237.pdf
- http://ilovefatjacks.store/uploads/1/3/0/4/130476034/jaruzaji.pdf
- http://nycmiddleschoolbasketballleague.com/uploads/1/3/0/4/130435715/3887914.pdf
- http://www.nurseinnovation.solutions/uploads/1/3/0/4/130476743/vizatulux.pdf
- http://sigmapivu.com/uploads/1/3/0/5/130540240/xewubagom_purokanu_vudowijude_kojoxina.pdf
- http://midgard-merchandise.com/uploads/1/3/0/3/130312961/bitebok_kowobiteruwug.pdf
- http://mysteinertech.com/uploads/1/3/1/1/131164052/26c7b1ad3e15239.pdf
- http://www.fernfiles.com/uploads/1/3/0/6/130639100/pexigasa-febowazefomuj.pdf
- http://artistsofvenice.com/uploads/1/3/0/5/130550681/sevitazim.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000096a6.bin529e1791860db4612e22f540ba2495868a51e46d59714f537f4108e3cca40252 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x96A6 | 8972 bytes |
font_01_sfnt_off0000b8a6.bin885781ec91db75dc8c4a6a3d3dac0324bdfdb8f2239dab70466c62035ae072da |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB8A6 | 4144 bytes |
font_02_sfnt_off0000c59f.bine971cc311348d9158489ac462786f2798eb1680dc0e41c1afe5454b2c8660b3b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC59F | 3580 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.