MALICIOUS
134
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF document contains a large number of external links, many of which point to cracked software or browser extensions, indicating a social engineering lure. One of the embedded URLs, http://mydrugdir.com/abaco/..., appears to be a download link for a malicious payload. The document's primary purpose is to trick users into downloading and executing potentially harmful software or installing malicious browser extensions.
Machine Learning
- Nyx PDF Classifier clean score 0.0137
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Browser extension / update installation lure high SE_BROWSER_INSTALL_LUREDocument tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://mydrugdir.com/abaco/ZG93bmxvYWR8ZUMxTm0xa2RIeDhNVFkxTmpnNU1qTTFNbng4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/alzheimer.consonance.fran.reimbursable.UFVNUC1GTE8UFV?scriptor=improved
- https://omaamart.com/wp-content/uploads/2022/07/Portable_GreenBrowser__Crack___Updated_2022.pdf
- https://www.agence-de-titres-services.be/sites/default/files/webform/betrbaka691.pdf
- https://consultation-allaitement-maternel.be/wp-content/uploads/2022/07/ActiveInbox_for_Chrome-1.pdf
- https://cristianosencontacto.com/wp-content/uploads/2022/07/SterJo_Password_Unmask.pdf
- https://apps.crg.es/system/files/webform/lemgrai245.pdf
- https://pqinsel.com/pq/advert/oglplus-updated-2022/
- https://evenimenteideale.ro/password-boss-2-0-2801-0-crack-for-windows-2022-latest/
- https://casacostaalmeria.com/wp-content/uploads/2022/07/Ozone_for_Winamp_3.pdf
- https://www.nwu.ac.za/sites/www.nwu.ac.za/files/files/i-institutional-information/quickstats/NWU-QuickStats-2020-2021.pdf
- https://dogrywka.pl/wp-content/uploads/2022/07/Commander.pdf
- https://marketingbadajoz.com/spybot-search-and-destroy-detection-update-crack-license-key-download/
- https://myperfecttutors.com/webcam-saver-3-9-9-3264bit-2022-new/
- https://theludwigshafen.com/wp-content/uploads/2022/07/One_Percent.pdf
- https://patmosrestoration.org/wp-content/uploads/2022/07/HTML_Viewer.pdf
- https://72bid.com?password-protected=login
- http://realslant.com/?p=10333
- https://telebook.app/upload/files/2022/07/dUSDruT1BCZASVonDcNb_04_f562e6a9e9646cd916301009d06dc897_file.pdf
- https://cristianosencontacto.com/wp-content/uploads/2022/07/propama.pdf
- https://lucviet.com/wp-content/uploads/2022/07/Vmdk2Phys_Crack_Serial_Number_Full_Torrent_April2022-1.pdf
- https://www.simonefiocco.com/index.php/2022/07/04/aplus-dvd-to-divx-xvid-ripper-crack-lifetime-activation-code-for-pc/
- https://omaamart.com/wp-content/uploads/2022/07/Portable_Green
- https://www.agence-de-titres-
- https://consultation-allaitement-maternel.be/wp-
- https://cristianosencontacto.com/wp-
- https://evenimenteideale.ro/password-boss-2-0-2801-0-crack-for-
- https://casacostaalmeria.com/wp-
- https://www.nwu.ac.za/sites/www.nwu.ac.za/files/files/i-institutional-
- https://marketingbadajoz.com/spybot-search-and-destroy-detection-
- https://myperfecttutors.com/webcam-
- https://theludwigshafen.com/wp-
- https://patmosrestoration.org/wp-
- https://telebook.app/upload/files/2022/07/dUSDruT1BCZASVonDcNb
- https://lucviet.com/wp-content/uploads/2022/07/Vmdk2Phys_Crack_
- https://www.simonefiocco.com/index.php/2022/07/04/aplus-dvd-to-
- http://www.tcpdf.org
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/mm/
- http://www.aiim.org/pdfa/ns/extension/
- http://www.aiim.org/pdfa/ns/schema#
- http://www.aiim.org/pdfa/ns/property#
- http://www.aiim.org/pdfa/ns/id/
Open this report in the interactive analyzer, or submit your own file for analysis.