MALICIOUS
114
Risk Score
Machine Learning
- Nyx PDF Classifier clean score 0.0015
Heuristics 5
-
Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARMPDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
-
PDF links to a cracked-software download doorway (base64-obfuscated) high PDF_CRACKED_SOFTWARE_DOWNLOAD_DOORWAYPDF's embedded link hides a pirated-software title as a base64 blob inside the URL path/query (and/or carries the ``download|`` doorway-template marker), rather than in visible text. This is a TCPDF-generated SEO doorway that ranks for software-piracy searches and funnels users to fake 'crack/keygen' download pages distributing adware, potentially-unwanted programs, or droppers. The base64 encoding is deliberate obfuscation to evade plaintext lure rules; the PDF itself carries no parser exploit — the risk is the linked crack-download destination.
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://thedirsite.com/bronchia/condemnation/mildewcide/densest/tashiro/translocation.ZG93bmxvYWR8WXo2YnpCdmZId3hOamN4TVRJd05URXdmSHd5TmpJMWZId29UU2tnVjI5eVpIQnlaWE56SUZ0UVJFWmQ?QXV0b0NBRAQXV PDF link annotation
- https://vaveyan.com/autocad-2021-24-0-con-llave-torrent-completo-del-numero-de-serie-2023/In PDF document text
- http://www.claseco.com/wp-content/uploads/2022/12/genomai.pdfIn PDF document text
- https://duolife.academy/descargar-bloques-de-autocad-gas-natural-new/In PDF document text
- https://www.myfreearticledirectory.com/wp-content/uploads/2022/12/Descargar-Autocad-Gratis-2014-Con-Crack-Y-Serial-Keygen-BETTER.pdfIn PDF document text
- https://www.riobrasilword.com/2022/12/15/como-descargar-el-programa-de-autocad-2016-gratis-exclusive/In PDF document text
- https://rebon.com.co/wp-content/uploads/2022/12/Descarga-gratis-AutoCAD-Con-Keygen-completo-For-Windows-x3264-ltimo-laNzamieNto-2022-Es.pdfIn PDF document text
- https://listingszilla.com/wp-content/uploads/2022/12/AutoCAD-1.pdfIn PDF document text
- https://shalamonduke.com/wp-content/uploads/2022/12/zimbdea.pdfIn PDF document text
- https://jacksonmoe.com/wp-content/uploads/2022/12/Descargar_Autocad_Para_Estudiantes_2020_FREE.pdfIn PDF document text
- https://quotidianosostenibile.it/autocad-2019-23-0-descarga-gratis-clave-de-licencia-incluye-clave-de-producto-mac-win-x64-2022/In PDF document text
- http://acadental.comIn PDF document text
- https://www.myfreearticledirectory.com/wp-content/uploads/2022/12/Descargar-Autocad-Gratis-2014-Con-Crack-In PDF document text
- https://rebon.com.co/wp-content/uploads/2022/12/Descarga-gratis-AutoCAD-Con-Keygen-completo-For-Windows-xIn PDF document text
- https://quotidianosostenibile.it/autocad-2019-23-0-descarga-gratis-clave-de-licencia-incluye-clave-de-producto-maIn PDF document text
- https://rebon.com.co/wp-content/uploads/2022/12/descarga-gratis-autocad-con-keygen-completo-for-windows-x3264-ltimo-lanzamiento-2022-es.pdfIn PDF document text
- http://thedirsite.com/bronchia/condemnation/mildewcide/densest/tashiro/translocation.zg93bmxvywr8wxo2ynpcdmzid3hoamn4tvrjd05urxdmshd5tmpjmwzid29uu2tnvji5evpiqnlawe56suz0uvjfwmq?qxv0b0nbraqxvIn PDF document text
- http://dejavu.sourceforge.netFontsIn extracted file (font_02_sfnt_off0000d204.bin)
- https://techplanet.today/post/descargar-objetos-autocadIn PDF document text
- https://techplanet.today/post/descargar-autocad-xyzIn PDF document text
- http://dejavu.sourceforge.netIn extracted file (stream_009_off0000658f.bin)
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (stream_009_off0000658f.bin)
- http://dejavu.sourceforge.net/wiki/index.php/LicenseDejaVuIn extracted file (font_02_sfnt_off0000d204.bin)
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_009_off0000658f.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x658F | 20588 bytes |
SHA-256: a3c7b4442c609eff987bafe7d0653430b600b960a8b6247c5cf491194ea53d5f |
|||
font_01_sfnt_off00009cf2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9CF2 | 20424 bytes |
SHA-256: df2d3aba96e0db4d2484592786fc014acd7f705728adc09fe1aa5cd7619bfc6a |
|||
font_02_sfnt_off0000d204.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD204 | 26892 bytes |
SHA-256: 440ba7b1b0fb2eb971275b07a98648fad327a18a6221b47420b3d824bf3a407a |
|||
font_03_sfnt_off000108be.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x108BE | 20828 bytes |
SHA-256: 66ee5a421be874c2bf64758e212dcdc74f7e5fbd5b562db26553446e87a084f1 |
|||
font_04_sfnt_off000141e9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x141E9 | 20820 bytes |
SHA-256: 381142a5b495fb73f95815c92d8245de3ee8524ebe0201b1f2eab01f80214d2c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.