MALICIOUS
134
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of external links, many of which are designed to appear as SEO-optimized content, advertising cracked software. One link points to a URL that appears to be a download for a movie. This suggests the document is part of a link farm intended to distribute malicious or unwanted software. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier clean score 0.0076
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINKPDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://lehmanbrotherbankruptcy.com/bursitis/ZG93bmxvYWR8NkM0T1dwb1pueDhNVFkxTnpFNE5qazFOWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/revues.groceries?ZG93bmxvYWQgbW92aWVzIGluIDcyMHAgTWFuamhpIFRoZSBNb3VudGFpbiBNYW4gMTA4MHAZG9.terrasse.tile PDF link annotation
- https://social.deospace.com/upload/files/2022/07/rwFs4syRGVYkwujw28EE_08_1920961db50d16733a0d1fa56b88972c_file.pdfIn PDF document text
- https://www.dejavekita.com/upload/files/2022/07/rT1JIwc9yhEWLYRnjNcg_08_54e11a8dba9e26c0878b5a439cd7a9bc_file.pdfIn PDF document text
- https://countymonthly.com/advert/sky-go-account-generator-_best_-cracked/In PDF document text
- https://telebook.app/upload/files/2022/07/FWV7cBVnEYRHeJqyqN4f_08_97ffd12daa80676ae1fb363714a42d4a_file.pdfIn PDF document text
- https://www.town.hull.ma.us/sites/g/files/vyhlif3286/f/uploads/hull_parking_regulations_notice_for_2021.pdfIn PDF document text
- https://world-online.co.za/advert/udaan-full-movie-download-720p-better/In PDF document text
- http://it-labx.ru/?p=66590In PDF document text
- http://www.rentbd.net/?p=26317In PDF document text
- http://www.chelancove.com/cod2-mp-crack-new-1-3-downloadl/In PDF document text
- https://followgrown.com/upload/files/2022/07/lgUJV5uDhQvUiUOHSfl4_08_97ffd12daa80676ae1fb363714a42d4a_file.pdfIn PDF document text
- https://promwad.com/sites/default/files/webform/tasks/ellyele526.pdfIn PDF document text
- https://veritasds.com/sites/default/files/webform/hanbar69.pdfIn PDF document text
- http://www.camptalk.org/windows-server-2012-r2-kmspico/In PDF document text
- https://www.cameraitacina.com/en/system/files/webform/feedback/assassinscreedivblackflagallunlockcrackv133dm7z-.pdfIn PDF document text
- https://www.cameraitacina.com/en/system/files/webform/feedback/busyaccountingsoftwarecrackserialdownloadfree.pdfIn PDF document text
- https://www.synergytherm.com/wp-content/uploads/2022/07/Download_Easy_Binder_20_UPD.pdfIn PDF document text
- https://kramart.com/lets-explore-farm-junior-field-trips-torrent-top-full/In PDF document text
- https://eastlakefc.com.au/sites/default/files/webform/cerekam236.pdfIn PDF document text
- https://farmaciacortesi.it/mathematica-10-keygen-ubuntu-mate-better/In PDF document text
- https://social.deospace.com/upload/files/2022/07/rwFs4syRGVYkwujw28EE_08_1920961db50d16733In PDF document text
- https://www.dejavekita.com/upload/files/2022/07/rT1JIwc9yhEWLYRnjNcg_08_54e11a8dba9e26c0878In PDF document text
- https://telebook.app/upload/files/2022/07/FWV7cBVnEYRHeJqyqN4f_08_97ffd12daa80676ae1fb36371In PDF document text
- https://www.town.hull.ma.us/sites/g/files/vyhlif3286/f/uploads/hull_parking_regulations_notice_for_20In PDF document text
- https://followgrown.com/upload/files/2022/07/lgUJV5uDhQvUiUOHSfl4_08_97ffd12daa80676ae1fb363In PDF document text
- https://www.cameraitacina.com/en/system/files/webform/feedback/assassinscreedivblackflagallunlocIn PDF document text
- https://www.cameraitacina.com/en/system/files/webform/feedback/busyaccountingsoftwarecrackseriIn PDF document text
- https://aulasvirtuales.zaragoza.unam.mx/cv/blog/index.php?entryid=12063In PDF document text
- http://www.tcpdf.orgIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign:
secureserver.net
1471 samples
Open this report in the interactive analyzer, or submit your own file for analysis.