MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of external links, many of which point to cracked software. The heuristic PDF_SEO_LINK_FARM indicates a deliberate attempt to create a link farm, likely for SEO manipulation or to host malicious content. The presence of URLs like http://mydrugdir.com/drydock/ suggests a lure for potentially harmful downloads.
Machine Learning
- Nyx PDF Classifier clean score 0.0119
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://mydrugdir.com/drydock/?implemantation=houer.WjN4IFNhbXN1bmcgMmcgVG9vbCBDcmFjawWjN.ZG93bmxvYWR8dEozWTNsMFlueDhNVFkxTmpjM01UZ3hPSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/burrill.irony
- http://lovelyonadime.com/?p=1410
- https://ig-link.com/vmware-vcenter-converter-standalone-4-3-torrent/
- https://antiquesanddecor.org/fajront-u-sarajevu-pdf-exclusive-download/
- https://keyandtrust.com/wp-content/uploads/2022/07/Renault_Can_Clip_Torrent_FULL-1.pdf
- https://xtc-hair.com/gorenje-wa-583-uputstvo-za-13https-scoutmails-com-index301-php-k-gorenje-wa-583-uputstvo-za-13/
- https://solaceforwomen.com/hd-online-player-one-by-two-malayalam-dubbed-movie-fr/
- http://gastro-professional.rs/uncategorized/hazrat-abdul-qadir-jilani-books-in-bangla-pdf-15-hot/
- https://extremesound.ru/dasha-ls-model-mega-top-129311-127999/
- https://tourismcenter.ge/wp-content/uploads/2022/07/MaxPayne3v10022patchcrack_BESTedREADNFOTHETA_Latest_Version.pdf
- https://www.scalping.es/wp-content/uploads/2022/07/Introduccion_Al_Derecho_1_Santiago_Lopez_Aguilar_Pdf_24.pdf
- https://www.afrogoatinc.com/upload/files/2022/07/ElFgV5BNNF8DjlTrLaPh_02_e9309246d17c5bf96f687060e0d5e0ee_file.pdf
- https://dailytimespro.com/wp-content/uploads/2022/07/waltal.pdf
- http://wp2-wimeta.de/renaultimmocodecalculatoriicrack-hot/
- https://www.acvconsultoria.com/wp-content/uploads/2022/07/CRACK_Windows_7_Ultimate_Sp1_64_Bit_Lite_V9_By_Nil.pdf
- https://6v9x.com/wp-content/uploads/2022/07/niagnewl.pdf
- https://www.apokoronews.gr/advert/crack-no-cd-toy-story-2-rar-hot/
- http://rydbergaren.se/wp-content/uploads/2022/07/yancalbu.pdf
- http://www.bevispo.eu/wp-content/uploads/2022/07/hyprotech_hysys_31_crack_free_14.pdf
- https://teupluchangaiper.wixsite.com/natoralperf/post/the-gods-must-be-crazy-3-torrent-download-link
- https://emealjobs.nttdata.com/en/system/files/webform/ambimarg888.pdf
- http://www.tcpdf.org
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/mm/
- http://www.aiim.org/pdfa/ns/extension/
- http://www.aiim.org/pdfa/ns/schema#
- http://www.aiim.org/pdfa/ns/property#
- http://www.aiim.org/pdfa/ns/id/
Open this report in the interactive analyzer, or submit your own file for analysis.