MALICIOUS
134
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of external links, many of which advertise cracked software, indicating a lure to potentially malicious websites. The heuristic PDF_SEO_LINK_FARM and PDF_CRACKED_SOFTWARE_LURE strongly suggest this is a link farm designed to drive traffic to sites offering pirated software. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier clean score 0.0098
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINKPDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://evacdir.com/MjAxMWxhcG9yYW5rZXVhbmdhbnB0c2lkb211bmN1bAMjA/ZG93bmxvYWR8cXU0YmpGcllueDhNVFkxTkRnNU16RTVNWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/chelurit.knuckles.expat?hedonists=penaeus PDF link annotation
- https://tutorizone.com/wp-content/uploads/2022/06/glorolen.pdfIn PDF document text
- http://feelingshy.com/new-compare-it-422221-portable/In PDF document text
- http://zyynor.com/upload/files/2022/06/KPxHVpjmF3TZkgFUokby_11_344b0b244e39285a3146d86e1c0a8a12_file.pdfIn PDF document text
- https://cine-africain.com/olislav/windows-2012-r2-terminal-server-license-crack-link/In PDF document text
- https://surprisemenow.com/notesinbusinesslawbyfidelitosorianopdf16/In PDF document text
- http://tutorialspointexamples.com/hd-online-player-download-bold-bollywood-movies-in-hi-linkIn PDF document text
- https://teenmemorywall.com/compuapps-swissknife-v3-license-key-crack-number-idm/In PDF document text
- http://www.divinejoyyoga.com/2022/06/11/asa-prepware-2013-activation-codes/In PDF document text
- http://zabarang.com/wp-content/uploads/2022/06/Descargar_Presto_88_Crack_Gratis.pdfIn PDF document text
- https://teenmemorywall.com/custom-xthea-drivers-for-windows-7-64-12-__exclusive__/In PDF document text
- https://remcdbcrb.org/wp-content/uploads/2022/06/sibori.pdfIn PDF document text
- https://plugaki.com/upload/files/2022/06/kbJaRU3nM8iATn68yC9d_11_92de28e6446c420a9b03cbe72fe3fbec_file.pdfIn PDF document text
- https://wp.gymbruneck.info/advert/call-of-juarez-the-cartel-steam-unlocked-best-crack-ali213-dude-version-download/In PDF document text
- https://seecurrents.com/wp-content/uploads/2022/06/a4u_hard_series_picture.pdfIn PDF document text
- https://seniordiscount.ca/wp-content/uploads/2022/06/napocurt.pdfIn PDF document text
- http://www.2el3byazici.com/?p=14526In PDF document text
- https://www.afaceripromo.ro/keyshia-cole-the-way-it-is-full-full-album-zip/In PDF document text
- http://tuscomprascondescuento.com/?p=26430In PDF document text
- https://www.cateringguiden.no/wp-content/uploads/2022/06/Pioneer_Carrozzeria_Aviczh9md_English_Manual.pdfIn PDF document text
- https://kramart.com/wp-content/uploads/2022/06/wakraf.pdfIn PDF document text
- http://zyynor.com/upload/files/2022/06/KPxHVpjmF3TZkgFUokby_11_344b0b244e39285a314In PDF document text
- https://plugaki.com/upload/files/2022/06/kbJaRU3nM8iATn68yC9d_11_92de28e6446c420a9b0In PDF document text
- https://wp.gymbruneck.info/advert/call-of-juarez-the-cartel-steam-unlocked-best-crack-In PDF document text
- https://www.cateringguiden.no/wp-In PDF document text
- http://zabarang.com/wp-content/uploads/2022/06/descargar_presto_88_crack_gratis.pdfIn PDF document text
- http://www.tcpdf.orgIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off000011d8.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x11D8 | 120140 bytes |
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.