← All detection heuristics · General
info
EMBEDDED_URL
What it means
One or more URLs were extracted from the document bytes but were not attributed to any other specific heuristic.
Why it fires
URL-themed rules attribute URLs they actually evaluated (e.g. PDF link annotations, macro download calls). URLs that appear in the file but were not tied to a specific finding are surfaced here so an analyst can still see and triage them. The per-finding detail names the most likely channel (e.g. 'Macro calls URL', 'PDF link annotation references URL') inferred from the other rules that fired on the same file.
Other General heuristics
POLYGLOT_PDF_APPENDED_ZIP_CVE_BUNDLE EXTRACTED_FILE_CLAMAV POLYGLOT_GIF_PDF_FORCEDENTRY_SHAPE SPEC_DIVERGENCE_HIGH PDF_EXTENSION_MISMATCH POLYGLOT_PDF_ZIP_APPENDED EXTRACTED_FILE_STATIC_TRIAGE CORPUS_HISTORICALLY_MALICIOUS POLYGLOT_TEXT_PDF POLYGLOT_ZIP_PREFIXED FORMAT_NEUTRAL_SCAN PPT_FOPT_COMPLEX_DATA_OVERFLOW PPT_FOPT_PROPERTY_TABLE_TRUNCATED CORPUS_RARE_COMBINATION CORPUS_RARE_STRUCTURAL_FEATURE_SET ANALYSIS_TIMEOUT_PARTIAL MACRO_VALID_PUBLISHER_SIGNATURE SCAN_OPTIONAL_STAGES_SKIPPED POLYGLOT_PDF_APPENDED_ZIP_SCAN_INCOMPLETE SCAN_INCOMPLETE UNKNOWN_FORMAT