MALICIOUS
224
Risk Score
Machine Learning
- Nyx PDF Classifier clean score 0.0006
Heuristics 7
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LUREPDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
-
Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARMPDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://seachtop.com/pels/affirms.ZG93bmxvYWR8SnA1WkhwM2QzeDhNVFkxT0RBd05qWTVPWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA.civilisations.berga/TWljcm9zb2Z0IEV4cHJlc3Npb24gRW5jb2RlciA0IFBybyBGdWxsIEFjdGl2YXRlZCBGcmVlIERvd25sb2FkIFRvcnJlbnRyYXITWl/cyanosis PDF link annotation
- https://ofsnl.nl/wp-content/uploads/2022/07/How_Hackers_hack_Facebook_password_with_Bruteforce.pdfIn PDF document text
- https://beachvisitorguide.com/wp-content/uploads/2022/07/Guitar_Pro_609_r9934_Full_keygen-1.pdfIn PDF document text
- http://buyzionpark.com/?p=45000In PDF document text
- https://mariana-flores-de-camino.com/mariana-flores-de-camino/cruel-intentions-1999-480p-mkv-400mbl/In PDF document text
- https://fmpconnect.com/wp-content/uploads/2022/07/VinylMaster_Xpt_serial21.pdfIn PDF document text
- https://marketing6s.com/index.php/advert/cummins-engine-serial-number-decoder-best/In PDF document text
- https://www.ibjf.at/wp-content/uploads/2022/07/Simplify3D_421_Multi_Utorrentl.pdfIn PDF document text
- https://burewalaclassified.com/advert/hal7600-v1-2-win7-activator/In PDF document text
- https://ctago.org/wp-content/uploads/2022/07/keylbail.pdfIn PDF document text
- http://www.b3llaphotographyblog.com/dc-unlocker-2-client-1-00-0805-crack-better-rar/In PDF document text
- http://findmallorca.com/lode-runner-the-legend-returns-download-windows-10-full/In PDF document text
- https://deccan-dental.com/smartshow-3d-cracked-crack-12-5-full-version/In PDF document text
- https://clubsoccer360.com/wp-content/uploads/2022/07/raybrye.pdfIn PDF document text
- https://fantasyartcomics.com/2022/07/17/ghostbusters-1984-720p-brrip-dual-audio-hindienglish-by-rans-clubz-verified-2/In PDF document text
- https://obscure-inlet-50168.herokuapp.com/Mathworks_Matlab_R2019a_64Bit_downloadbfdcm.pdfIn PDF document text
- https://gembeltraveller.com/sta4cad-v131-crack-free-14-top/In PDF document text
- https://spaziofeste.it/wp-content/uploads/chrmaf.pdfIn PDF document text
- https://vv411.com/advert/studer-a800-multichannel-tape-recorder-plugin-extra-quality-crack/In PDF document text
- https://orbeeari.com/windows-7-extremo-sp1-hd-x17-0-full-32-bits-spanish-utorrent-free/In PDF document text
- https://rwix.ru/they-are-billions-unlock-maps.htmlIn PDF document text
- https://ofsnl.nl/wp-content/uploads/2022/07/How_Hackers_hack_Facebook_In PDF document text
- https://beachvisitorguide.com/wp-In PDF document text
- https://mariana-flores-de-camino.com/mariana-flores-de-camino/cruel-In PDF document text
- https://fmpconnect.com/wp-In PDF document text
- https://marketing6s.com/index.php/advert/cummins-engine-serial-number-In PDF document text
- https://www.ibjf.at/wp-In PDF document text
- http://www.b3llaphotographyblog.com/dc-In PDF document text
- http://findmallorca.com/lode-runner-the-legend-returns-download-In PDF document text
- https://fantasyartcomics.com/2022/07/17/ghostbusters-1984-720p-brrip-In PDF document text
- https://obscure-inlet-50168.herokuapp.com/Mathworks_Matlab_R2019a_64In PDF document text
- https://vv411.com/advert/studer-a800-multichannel-tape-recorder-plugin-In PDF document text
- https://orbeeari.com/windows-7-extremo-sp1-hd-x17-0-full-32-bits-spanish-In PDF document text
- http://seachtop.com/pels/affirms.zg93bmxvywr8sna1wkhwm2qzedhnvfkxt0rbd05qwtvpwhg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda.civilisations.berga/twljcm9zb2z0iev4chjlc3npb24grw5jb2rlcia0ifbybybgdwxsiefjdgl2yxrlzcbgcmvliervd25sb2fkifrvcnjlbnryyxitwl/cyanosisIn PDF document text
- http://www.tcpdf.orgIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign:
secureserver.net
1471 samples
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00002aff.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2AFF | 84648 bytes |
SHA-256: 0b6c48f6a4e931a4572b13bb2af9ad514b0702ea3c747f8534c05d2c57946ed4 |
|||
font_01_sfnt_off0000b362.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB362 | 83036 bytes |
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.