SUSPICIOUS
34
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains multiple links advertising cracked software, a known lure for malware distribution. One of the embedded URIs, http://xtraserp.com/abrugar.dGNhZG1pbiAyIDAgY3JhY2tlZCAxOAdGN/aggravating/ZG93bmxvYWR8NUsyWTJaNU9IeDhNVFkxTnpBMk56RTFOSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA.marmalade/celevac/equaling/fund/steamships, is particularly suspicious due to its obfuscated structure. While no scripts were directly extracted, the PDF's nature suggests it's a phishing document designed to trick users into downloading potentially malicious software.
Machine Learning
- Nyx PDF Classifier clean score 0.0103
Heuristics 3
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://xtraserp.com/abrugar.dGNhZG1pbiAyIDAgY3JhY2tlZCAxOAdGN/aggravating/ZG93bmxvYWR8NUsyWTJaNU9IeDhNVFkxTnpBMk56RTFOSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA.marmalade/celevac/equaling/fund/steamships PDF link annotation
- https://www.alnut.com/recipe-for-natales-philly-fluff-cake-recipe/In PDF document text
- https://www.drbonesonline.com/2022/07/06/dirt-3-english-language-files-36-link/In PDF document text
- http://it-labx.ru/?p=63980In PDF document text
- https://theoceanviewguy.com/wp-content/uploads/2022/07/Ulead_Cool_3d_Crack_Free_Download_TOP.pdfIn PDF document text
- https://kramart.com/dragon-ball-xenoverse-2-mods-ps4-download-__link__/In PDF document text
- http://www.cad2parts.com/?p=11896In PDF document text
- http://markettechnews.com/?p=2629In PDF document text
- https://salty-peak-19070.herokuapp.com/vag_com_vcds_9082_en_full_fr.pdfIn PDF document text
- https://asu-bali.jp/wp-content/uploads/2022/07/lorvit.pdfIn PDF document text
- https://arcmaxarchitect.com/sites/default/files/webform/magic-photo-editor-free-download-with-serial-numbertrmdsf.pdfIn PDF document text
- http://discoverlosgatos.com/?p=19624In PDF document text
- http://westghostproductions.com/2022/07/06/aurora-3d-barcode-generator-full-crack-free-keygen-serial-18/In PDF document text
- http://www.giffa.ru/uncategorized/fishandfisheriesofindiabyvgjhingranpdf151/In PDF document text
- https://www.viaggisaturno.it/wp-content/uploads/2022/07/chagen.pdfIn PDF document text
- https://fystop.fi/p3d-v4-fsdg-seychelles-ripproper-tool-best/In PDF document text
- http://shalamonduke.com/?p=45438In PDF document text
- https://www.arunachalreflector.com/2022/07/06/download-supermarket-mania-pc-game-mediafire-link-free/In PDF document text
- https://emealjobs.nttdata.com/en/system/files/webform/autorennbahnplaner-2011-full-version.pdfIn PDF document text
- https://prininexanmotu.wixsite.com/knowerperka::knowerperka:TFAjUMq3gg:prininexanmotu@mail.com/post/download-install-ebook-10-sahabat-yang-dijamin-masuk-surgaIn PDF document text
- https://voyles116t.wixsite.com/tracatcosgai/post/intex-wireless-usb-adapter-itulc25-driverIn PDF document text
- http://www.tcpdf.orgIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_009_off00019a5a.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x19A5A | 119072 bytes |
SHA-256: df221e87b81d1531cafdadb6c09a602e9f604d1baf0a17bbd350cbb83baa06f7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.