MALICIOUS
134
Risk Score
Machine Learning
- Nyx PDF Classifier clean score 0.0014
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARMPDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://lehmanbrotherbankruptcy.com/b25heXVtIGFhdHVrdXR0aXl1bSBtb3ZpZSBkb3dubG9hZCBkdmRyaXAgdG9ycmVudAb25/choultries/courted.lumped?mecs=ZG93bmxvYWR8OEluY2poa2QzeDhNVFkxT0RJeE9EazROWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA.guangzhe&brownish=underworld PDF link annotation
- https://myirishconnections.com/2022/07/25/In PDF document text
- https://electricnews.fr/wp-content/uploads/2022/07/pancsaf.pdfIn PDF document text
- https://douglasdinesout.com/wp-content/uploads/2022/07/harnata.pdfIn PDF document text
- https://munchyn.com/wp-content/uploads/2022/07/Pixelan_Spicemaster_25_Serial_Number.pdfIn PDF document text
- http://media.snuff24.se/2022/07/kelray.pdfIn PDF document text
- http://rbics.net/?p=7848In PDF document text
- https://www.velocitynews.co.nz/advert/antideepfreezeallversionrar-work/In PDF document text
- https://vincyaviation.com/alien-breed-impact-v1-0-0-120-multi6-cracked-read-nfo-theta-download-for-computer-updated/In PDF document text
- http://greencitywallonie.be/index.php/2022/07/25/crack-3d-sexvilla-2-everlust-__top__/In PDF document text
- http://chemistrygate.com/wp-content/uploads/2022/07/Navisworks_Manage_2016_Crack_UPD_17.pdfIn PDF document text
- https://www.hellodanes.com/wp-content/uploads/2022/07/font_psl_kittithada_download.pdfIn PDF document text
- https://arlingtonliquorpackagestore.com/ik-multimedia-miroslav-philharmonik-serial-number-verified/In PDF document text
- http://festivaldelamor.org/?p=5069314In PDF document text
- https://lifeproject.fr/mapinfo-discover-crack-free-download-best/In PDF document text
- https://www.berlincompanions.com/red-alert-2-yuris-revenge-mac-download-exclusive/?p=26712In PDF document text
- http://ice-aec.com/index.php/2022/07/25/blu-arjun-the-warrior-prince-tamil-movies-1080p-torrent-patched/In PDF document text
- https://gwttechnologies.com/wp-content/uploads/2022/07/Microsoft_Sql_Server_2012_Enterprise_Free_Product_Key_Crack_Torrent_BEST.pdfIn PDF document text
- https://floridachiropracticreport.com/advert/portable-micrografx-designer-9-0-1-pro-x86x64-isabella-ninja-omnip-top/In PDF document text
- https://gracepluscoffee.com/the-concubine-korean-movie-2012-14/In PDF document text
- http://www.hva-concept.com/wp-content/uploads/2022/07/driver_navigator_2013_crack.pdfIn PDF document text
- http://chemistrygate.com/wp-content/uploads/2022/07/navisworks_manage_2016_crack_upd_17.pdfIn PDF document text
- http://lehmanbrotherbankruptcy.com/b25hexvtigfhdhvrdxr0axl1bsbtb3zpzsbkb3dubg9hzcbkdmryaxagdg9ycmvudab25/choultries/courted.lumped?mecs=zg93bmxvywr8oeluy2poa2qzedhnvfkxt0rjee9eazrowhg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda.guangzhe&brownish=underworldIn PDF document text
- http://www.tcpdf.orgIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000018ea.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x18EA | 84584 bytes |
SHA-256: 5426beb2453db159cb1642f8570c9b889eec3e4f2c936411c4a7727fc89ac333 |
|||
font_01_sfnt_off0000a115.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA115 | 83036 bytes |
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.