MALICIOUS
64
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of external links, many of which appear to be SEO-optimized to lure users into downloading software. One prominent URL, http://evacdir.com/comuter.cgmp?ZG93bmxvYWR8SU00YTJsellueDhNVFkxTnpBMk56RTFOSHg4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk=/TWluaVRvb2wgUG93ZXIgRGF0YSBSZWNvdmVyeSBGcmVlIEVkaXRpb24gOC4xIENyYWNrTWl/firestorms/icann/, is likely a malicious download. The PDF structure and link farm suggest an attempt to distribute potentially unwanted or malicious software.
Machine Learning
- Nyx PDF Classifier clean score 0.0139
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://evacdir.com/comuter.cgmp?ZG93bmxvYWR8SU00YTJsellueDhNVFkxTnpBMk56RTFOSHg4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk=/TWluaVRvb2wgUG93ZXIgRGF0YSBSZWNvdmVyeSBGcmVlIEVkaXRpb24gOC4xIENyYWNrTWl/firestorms/icann/ PDF link annotation
- http://www.giffa.ru/fashionjewelry/luminar-4-crack-new-keygen-free-download/In PDF document text
- https://thebrothers.cl/wp-content/uploads/2022/07/paxjan.pdfIn PDF document text
- https://ready2reading.com/wp-content/uploads/2022/07/Adobe_Acrobat_Xi_Pro_Free_Download_For_Windows_8_FULL.pdfIn PDF document text
- https://www.realvalueproducts.com/sites/realvalueproducts.com/files/webform/men-of-war-vietnam-v-1001-full-trainer.pdfIn PDF document text
- https://khadijahshowroom.com/2022/07/06/wwe-smackdown-vs-raw-2006-pc-version-fitgirl-repack-extra-quality/In PDF document text
- https://wishfruits.com/cadprofi-9-07-patched-keygen-crack/In PDF document text
- https://powerful-badlands-19627.herokuapp.com/ghazymr.pdfIn PDF document text
- https://dry-mesa-00465.herokuapp.com/markkeir.pdfIn PDF document text
- https://yooyi.properties/wp-content/uploads/2022/07/ShestheManHDTV720px264.pdfIn PDF document text
- https://technospace.co.in/upload/files/2022/07/8FBqUpWZvyoLYUZgq89R_06_dc9555fcabba6984566e8b6e04da2fda_file.pdfIn PDF document text
- https://www.southwickma.org/sites/g/files/vyhlif1241/f/uploads/zoning_districts_1.pdfIn PDF document text
- https://whispering-shelf-10023.herokuapp.com/janealis.pdfIn PDF document text
- https://www.farmington.nh.us/sites/g/files/vyhlif566/f/uploads/transfer_station_information_flyer.pdfIn PDF document text
- https://www.lmbchealth.com/advert/high-standard-sport-king-serial-number-lookup-install/In PDF document text
- http://joshuatestwebsite.com/hd-online-player-asterisk-essentials-online-video-tra-work/In PDF document text
- http://conbluetooth.net/?p=26186In PDF document text
- https://www.spanko.net/upload/files/2022/07/gGgSZJvtCF2SYwX5bMbz_06_429c445c2e633ab5f8850c823c4ea082_file.pdfIn PDF document text
- https://okutimur.com/wp-content/uploads/2022/07/Epson_sx230_resetrar.pdfIn PDF document text
- https://www.tamtam.boutique/wp-content/uploads/2022/07/verrgebh.pdfIn PDF document text
- http://www.giffa.ru/fashionjewelry/luminar-4-crack-new-keygen-free-In PDF document text
- https://ready2reading.com/wp-content/uploads/2022/07/Adobe_AcroIn PDF document text
- https://www.realvalueproducts.com/sites/realvalueproducts.com/filesIn PDF document text
- https://khadijahshowroom.com/2022/07/06/wwe-smackdown-vs-In PDF document text
- https://yooyi.properties/wp-In PDF document text
- https://technospace.co.in/upload/files/2022/07/8FBqUpWZvyoLYUZgqIn PDF document text
- https://www.southwickma.org/sites/g/files/vyhlif1241/f/uploads/zoninIn PDF document text
- https://www.farmington.nh.us/sites/g/files/vyhlif566/f/uploads/transfeIn PDF document text
- https://www.lmbchealth.com/advert/high-standard-sport-king-serial-In PDF document text
- http://joshuatestwebsite.com/hd-online-player-asterisk-essentials-In PDF document text
- https://www.spanko.net/upload/files/2022/07/gGgSZJvtCF2SYwX5bMIn PDF document text
- https://okutimur.com/wp-In PDF document text
- https://www.tamtam.boutique/wp-In PDF document text
- https://library.uoregon.edu/system/files/webform/apc_application/halglad760.pdfIn PDF document text
- http://www.tcpdf.orgIn PDF document text
- https://library.uoregon.edu/system/files/webform/apc_application/halIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign:
secureserver.net
1471 samples
Open this report in the interactive analyzer, or submit your own file for analysis.