MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF document contains a large number of external links, many of which are designed to lure users into downloading cracked software. One of the embedded URLs, http://dormister.com/alds/ZG93bmxvYWR8NkFHZEdwbVozeDhNVFkxTmpjM01UZ3hPSHg4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk?smith=/banners/malinchak/phenoms/Q2FsaWZvcm5pYSBEcml2ZXJzIExpY2Vuc2UgVGVtcGxhdGUgUGhvdG9zaG9wQ2F.klegon, appears to be a download URL for a second-stage payload. The PDF's structure and extensive link farm suggest a phishing or malware distribution campaign.
Machine Learning
- Nyx PDF Classifier clean score 0.0087
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://dormister.com/alds/ZG93bmxvYWR8NkFHZEdwbVozeDhNVFkxTmpjM01UZ3hPSHg4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk?smith=/banners/malinchak/phenoms/Q2FsaWZvcm5pYSBEcml2ZXJzIExpY2Vuc2UgVGVtcGxhdGUgUGhvdG9zaG9wQ2F.klegon PDF link annotation
- https://friendship.money/upload/files/2022/07/qDgDntpHj5qgz5ypW18V_03_57fa46ab30412b1930f2e03e0b781437_file.pdfIn PDF document text
- https://efekt-metal.pl/witaj-swiecie/In PDF document text
- http://dottoriitaliani.it/ultime-notizie/alimentazione/alien-skin-eye-candy-7-2-2-20-x64-medicinebabupc-keygen-install/In PDF document text
- https://boiling-cove-35993.herokuapp.com/Clinical_Pharmacy_Practice_Parthasarathy_Pdf_121.pdfIn PDF document text
- https://ferie-bolig.dk/creanga-de-aur-james-frazer-pdf-25-2021/In PDF document text
- https://rednails.store/librecadhandbuchdeutschpdfdownload-repack/In PDF document text
- https://www.pivatoporte.com/wp-content/uploads/2022/07/jazziany-1.pdfIn PDF document text
- https://ameeni.com/upload/files/2022/07/MP44kmRD5WQC8to548Nt_03_57fa46ab30412b1930f2e03e0b781437_file.pdfIn PDF document text
- http://yogaapaia.it/archives/31750In PDF document text
- https://evonegocio.com/wp-content/uploads/2022/07/beryola.pdfIn PDF document text
- https://www.cbdorganics.mx/wp-content/uploads/2022/07/Rocscience_Rocplane_V2_029rarl.pdfIn PDF document text
- http://uttaranchalcollege.com/wp-content/uploads/2022/07/Sims_3_Crack_Alle_Erweiterungen_21.pdfIn PDF document text
- https://globe-med.com/crack-intuit-quickbooks-enterprise-18-0-r3-license-keyl-exclusive/In PDF document text
- http://trabajosfacilespr.com/wp-content/uploads/2022/07/CRACK_ARTA_Audio_Measurement_And_Analysis_Software_V182_Incl_Keygen_PORTABLE.pdfIn PDF document text
- http://hotelthequeen.it/2022/07/03/the-filmmakers-guide-to-visual-effects-the-art-and-techniques-of-vfx-for-directors-producers-editors-and-cinematographers-verified-download-epub-mobi-pdf-fb2/In PDF document text
- http://brainworksmedia.in/uncategorized/full-movie-the-legend-of-bhagat-singh-720p-__exclusive__/In PDF document text
- http://imeanclub.com/?p=74081In PDF document text
- https://k22.be/wp-content/uploads/2022/07/londerb.pdfIn PDF document text
- https://www.jomp.org/files/webform/financialaid/fayhana541.pdfIn PDF document text
- https://www.mcgill.ca/psychiatricgenetics/system/files/webform/ganymark584.pdfIn PDF document text
- http://www.tcpdf.orgIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000032d9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x32D9 | 84508 bytes |
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c |
|||
font_01_sfnt_off0000bac5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xBAC5 | 83036 bytes |
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.