MALICIOUS
124
Risk Score
Machine Learning
- Nyx PDF Classifier clean score 0.0005
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LUREPDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://evacdir.com/frequency/rett/rationalist?ZG93bmxvYWR8YmM5TVdjd2VueDhNVFkxTkRjek1EZzRObng4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA.honeyed.nineveh.SU9iaXQgQWR2YW5jZWQgU3lzdGVtQ2FyZSBQcm8gMTIuNC4wLjM1MSBLZXlzIHwgNDUgTUISU9 PDF link annotation
- https://intermountainbiota.org/portal/checklists/checklist.php?clid=76636In PDF document text
- https://corosocial.com/upload/files/2022/06/vLnAzcgbnf5Kkh1ehqBH_09_103515a130d558d75bbdf54b6a2b8540_file.pdfIn PDF document text
- https://innovacioncosmetica.com/wp-content/uploads/2022/06/Expression_Blend_3_Crack_4.pdfIn PDF document text
- https://novinmoshavere.com/wp-content/uploads/2022/06/laugeni.pdfIn PDF document text
- https://www.pteridoportal.org/portal/checklists/checklist.php?clid=10875In PDF document text
- https://www.almawomenboutique.com/wp-content/uploads/2022/06/Reason_6_license_number_registration_coderar.pdfIn PDF document text
- https://joomic.com/upload/files/2022/06/QvjzkIYZNMHTW4TEMogV_09_103515a130d558d75bbdf54b6a2b8540_file.pdfIn PDF document text
- https://btr-pen.com/wp-content/uploads/2022/06/Substitute_Teacher_3_720p_Torrent.pdfIn PDF document text
- https://biorepo.neonscience.org/portal/checklists/checklist.php?clid=3714In PDF document text
- https://365hdnews.com/wp-content/uploads/2022/06/deenwal.pdfIn PDF document text
- https://tazzakhabar.com/2022/06/hawas-ki-intehaa-full-work-movie-2015-hd-1080p/In PDF document text
- http://chatroom.thabigscreen.com:82/upload/files/2022/06/h7dD4wJU3P9nqb9DqyZs_09_103515a130d558d75bbdf54b6a2b8540_file.pdfIn PDF document text
- https://letthemeatcottoncandy.de/wp-content/uploads/2022/06/EroticaX160603LanaRhoadesImagine_1080pMP4_3_6.pdfIn PDF document text
- https://griegoeasy.com/blog/index.php?entryid=56In PDF document text
- http://connect.tg/wp-content/uploads/2022/06/pribirl.pdfIn PDF document text
- https://www.ocacp.com/wp-content/uploads/2022/06/Deep_Hiarcs_14_Uci_Chess_Engine_Download.pdfIn PDF document text
- https://islandcremations.com/wp-content/uploads/2022/06/Caged_2011_Dutch_English_Subtitles.pdfIn PDF document text
- https://schumann-resonance.org/wp-content/uploads/2022/06/Ek_Paheli_Leela_movie_download_hd_kickass.pdfIn PDF document text
- https://fotofables.com/wp-content/uploads/2022/06/Hematologia_clinica_mckenzie_Descargar_Libros_PDFpdfgolkesbf.pdfIn PDF document text
- https://vegetarentusiast.no/wp-content/uploads/2022/06/Duplicate_1998MP3VBR320Kbps__VMR_UPD.pdfIn PDF document text
- https://corosocial.com/upload/files/2022/06/vLnAzcgbnf5Kkh1ehqBH_09_103515a130d558d75bbdf54b6a2b8In PDF document text
- https://www.almawomenboutique.com/wp-In PDF document text
- https://joomic.com/upload/files/2022/06/QvjzkIYZNMHTW4TEMogV_09_103515a130d558d75bbdf54b6a2bIn PDF document text
- http://chatroom.thabigscreen.com:82/upload/files/2022/06/h7dD4wJU3P9nqb9DqyZs_09_103515a130d558d7In PDF document text
- https://letthemeatcottoncandy.de/wp-In PDF document text
- https://schumann-resonance.org/wp-In PDF document text
- https://fotofables.com/wp-In PDF document text
- http://evacdir.com/frequency/rett/rationalist?zg93bmxvywr8ymm5tvdjd2vuedhnvfkxtkrjek1ezzrobng4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda.honeyed.nineveh.su9iaxqgqwr2yw5jzwqgu3lzdgvtq2fyzsbqcm8gmtiunc4wljm1msblzxlzihwgndugtuisu9In PDF document text
- http://www.tcpdf.orgIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign:
secureserver.net
1471 samples
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_009_off00002e5f.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x2E5F | 120140 bytes |
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4 |
|||
font_01_sfnt_off0000dc42.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDC42 | 76772 bytes |
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.