MALICIOUS
122
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF document contains a link farm that advertises cracked and pirated software, indicating a lure to potentially malicious content. Several external URIs were extracted, including one pointing to a raw IP address, suggesting an attempt to direct users to potentially harmful sites. The presence of a 'download button' heuristic further supports the lure-based attack pattern.
Machine Learning
- Nyx PDF Classifier clean score 0.0314
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Clickable URI points to raw IP address medium PDF_URI_IP_LITERALPDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://findthisall.com/contrivances/overstock.romeu?everly=jerking&TWFya2l6IERlIFNhZCAxMjAgRGFuYSBTb2RvbWUgUGRmIERvd25sb2FkTWF=ZG93bmxvYWR8eEw3YW1kbE1ueDhNVFkxTnpBMk56RTFOSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA== PDF link annotation
- https://www.waldportoregon.gov/sites/g/files/vyhlif6536/f/uploads/public_records_request_policy_and_form_.pdfIn PDF document text
- https://inobee.com/upload/files/2022/07/vqkWHKmrmznT7mnwZVyL_06_ad37e25b0c73611e9f2b3d75d3183c6e_file.pdfIn PDF document text
- https://www.mindq.co.bw/sites/default/files/webform/ferflan761.pdfIn PDF document text
- https://www.chiesacristiana.eu/2022/07/06/horoscope-explorer-pro-5-03-crack-best-serial-keygen-cd-key-rar/In PDF document text
- https://natsegal.com/autocad-2006-portable-__hot__-keygen/In PDF document text
- https://bullygirlmagazine.com/advert/resident-evil-5-iso-ps2-top/In PDF document text
- https://www.juniperhillpta.uk/wp-content/uploads/2022/07/VEGA_Conflict_Cheats_And_Hacks_9999999999_Coins.pdfIn PDF document text
- https://www.artec3d.com/system/files/webform/business_development/alisyaky612.pdfIn PDF document text
- https://dincampinginfo.dk/wp-content/uploads/2022/07/moninect.pdfIn PDF document text
- https://mauislocal.com/wp-content/uploads/2022/07/Spellbound_Korean_Movie_Eng_Sub_Torrent_FULL_Download.pdfIn PDF document text
- https://1orijin.com/upload/files/2022/07/khJcYb6GT61LRcsxlBim_06_ad37e25b0c73611e9f2b3d75d3183c6e_file.pdfIn PDF document text
- http://richard-wagner-werkstatt.com/?p=74853In PDF document text
- http://www.chandabags.com/koi-mil-gaya-full-movie-download-mp4-720p-repack/In PDF document text
- https://www.griecohotel.it/descargar-gran-turismo-4-pc-espaol-utorrent-install/In PDF document text
- https://4s71.com/nostale-minigame-bot-download-repack-2/In PDF document text
- http://18.138.249.74/upload/files/2022/07/l2HSpsvhiebr7s6hFCrk_06_ad37e25b0c73611e9f2b3d75d3183c6e_file.pdfPDF link annotation
- https://ipayif.com/upload/files/2022/07/teAAFfVMBRgnnjCJdVPq_06_ad37e25b0c73611e9f2b3d75d3183c6e_file.pdfIn PDF document text
- https://www.ludomar.com/wp-content/uploads/2022/07/REPACK_Keygen_Para_Activar_AutoCAD_Mechanical_2018_64_Bits.pdfIn PDF document text
- https://www.waldportoregon.gov/sites/g/files/vyhlif6536/f/uploads/public_records_request_policy_andIn PDF document text
- https://inobee.com/upload/files/2022/07/vqkWHKmrmznT7mnwZVyL_06_ad37e25b0c73611e9f2b3d7In PDF document text
- https://www.chiesacristiana.eu/2022/07/06/horoscope-explorer-pro-5-03-crack-best-serial-keygen-cd-In PDF document text
- https://www.juniperhillpta.uk/wp-In PDF document text
- https://mauislocal.com/wp-In PDF document text
- https://1orijin.com/upload/files/2022/07/khJcYb6GT61LRcsxlBim_06_ad37e25b0c73611e9f2b3d75d31In PDF document text
- http://18.138.249.74/upload/files/2022/07/l2HSpsvhiebr7s6hFCrk_06_ad37e25b0c73611e9f2b3d75d3PDF link annotation
- https://ipayif.com/upload/files/2022/07/teAAFfVMBRgnnjCJdVPq_06_ad37e25b0c73611e9f2b3d75d31In PDF document text
- https://www.ludomar.com/wp-In PDF document text
- https://mauislocal.com/wp-content/uploads/2022/07/spellbound_korean_movie_eng_sub_torrent_full_download.pdfIn PDF document text
- https://au.int/es/system/files/webform/au3rdIn PDF document text
- http://www.tcpdf.orgIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign:
secureserver.net
1471 samples
Open this report in the interactive analyzer, or submit your own file for analysis.