MALICIOUS
174
Risk Score
Machine Learning
- Nyx PDF Classifier clean score 0.0046
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
PDF links to document on public blob storage high PDF_PUBLIC_BLOB_DOCUMENT_LINKPDF contains a clickable action to a document payload hosted on public blob/object storage. Shared object storage can be used legitimately, so this rule is suspicious rather than conclusive unless paired with lure text or other phishing indicators.
-
Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARMPDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://evacdir.com/RGVzY2FyZ2FyIFBsYW5pbGxhIERlIFBhZ28gRGVsIFNlbmlhdCBEcG4gMjURGV/cornflakes.novelist.ZG93bmxvYWR8bDd3WVhNNFozeDhNVFkxTkRjNE1EYzROM3g4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA?aggressions=rollie&rtanswers=tandoori PDF link annotation
- http://exponor.mercurioantofagasta.cl/advert/3d-optical-mouse-rating-5v-100ma-driver-download-portable/In PDF document text
- https://startclube.net/upload/files/2022/06/FFkxCDhfXDRAXuQZPasm_09_9ebbb4be8783c9737b3ee0bedf53b239_file.pdfIn PDF document text
- https://eleve-efb.fr/wp-content/uploads/2022/06/Halo_4_Passwordtxt.pdfIn PDF document text
- http://www.zebrachester.com/lumion-3-32-bit-torrent-angels-melinda-villa/In PDF document text
- https://storage.googleapis.com/faceorkut.com/upload/files/2022/06/Pmz2uD5oto2bNdC5ZJhC_09_9ebbb4be8783c9737b3ee0bedf53b239_file.pdfIn PDF document text
- https://thenationalreporterng.com/ontrack-easyrecovery-professional-technician-v12-0-0-2-dc-better-keygen/In PDF document text
- https://www.inscriu.ro/wp-content/uploads/2022/06/Catzilla_4K__Advanced_Full_Crack_crack.pdfIn PDF document text
- https://pi-psy.org/wp-content/uploads/2022/06/natflo.pdfIn PDF document text
- https://dailyjaguar.com/wp-content/uploads/2022/06/Download_Driver_Modem_Usb_Huawei_E173_TOP.pdfIn PDF document text
- https://gowestshore.com/wp-content/uploads/descargarenciclopediaencarta2009gratisparawindows7.pdfIn PDF document text
- https://www.yapidurealestate.com/windows-7-ab-april-2019-wird-ein-������sha-2-update����-benotigt-free/In PDF document text
- https://croatiansincleveland.com/wp-content/uploads/2022/06/fritam.pdfIn PDF document text
- https://pteridoportal.org/portal/checklists/checklist.php?clid=12638In PDF document text
- https://bramshawbv.com/?p=40225In PDF document text
- http://ampwebsitedesigner.com/wp-content/uploads/2022/06/writphy.pdfIn PDF document text
- https://p2p-tv.com/wp-content/uploads/2022/06/Metasploit_License_Key_Crack.pdfIn PDF document text
- https://tarpnation.net/x-force-keygen-autocad-lt-2016-64-bit-free-download/In PDF document text
- https://webtium.com/wp-content/uploads/2022/06/Nuendo_5_Usb_Elicenser_Crack_Serial_Torrent_Download.pdfIn PDF document text
- https://meuconhecimentomeutesouro.com/adan-zye-php-pdf-indir/In PDF document text
- http://evacdir.com/rgvzy2fyz2fyifbsyw5pbgxhierlifbhz28grgvsifnlbmlhdcbecg4gmjurgv/cornflakes.novelist.zg93bmxvywr8bdd3wvhnnfozedhnvfkxtkrjne1eyzrom3g4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda?aggressions=rollie&rtanswers=tandooriIn PDF document text
- https://serv.biokic.asu.edu/paleo/portal/checklists/checklist.php?clid=4859In PDF document text
- http://www.tcpdf.orgIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign:
shared payload 4d76c2b8d2
5 samples
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off00001271.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x1271 | 120748 bytes |
SHA-256: 4d76c2b8d2ed9222de382323e6eae624da6c33f61dca8bd7f892ff4b34bebdc2 |
|||
stream_007_off00010477.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x10477 | 119072 bytes |
SHA-256: df221e87b81d1531cafdadb6c09a602e9f604d1baf0a17bbd350cbb83baa06f7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.