MALICIOUS
64
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
T1204.002 Malicious Link
The PDF document contains a large number of external links, many of which appear to be SEO-optimized and lead to download sites for cracked software. The heuristic 'PDF_SEO_LINK_FARM' indicates a deliberate attempt to create a link farm, likely to distribute malware or facilitate phishing. The embedded URL 'http://blogbasters.com/gesticulation.impounded.YmxhY2ttYWdpYyBtZWRpYSBleHByZXNzIGRvd25sb2FkIHNvZnR3YXJlYmx/sherpas/ZG93bmxvYWR8ZXc3WTNvMWNueDhNVFkxTmpjeE1qTXdOWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA.indulgences' is a primary indicator of a malicious destination.
Machine Learning
- Nyx PDF Classifier clean score 0.0077
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://blogbasters.com/gesticulation.impounded.YmxhY2ttYWdpYyBtZWRpYSBleHByZXNzIGRvd25sb2FkIHNvZnR3YXJlYmx/sherpas/ZG93bmxvYWR8ZXc3WTNvMWNueDhNVFkxTmpjeE1qTXdOWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA.indulgences
- https://hanffreunde-braunschweig.de/candydollvalensiyasset4115-better/
- https://pascanastudio.com/art-modeling-liliana-model-sets-01-89/
- https://www.corsisj2000.it/wp-content/uploads/2022/07/gran_turismo_6_pc_crack_64.pdf
- http://supreo.fr/wp-content/uploads/2022/07/the_man_who_sold_the_world_bowie_mp3_download.pdf
- https://sundtindtag.dk/%Alternativ
- https://toronto-dj.com/advert/packmage-2-0-1-0-best-crack-software/
- https://believewedding.com/wp-content/uploads/2022/07/City_Car_Driving_Free_Download_V227_Crackl_UPD.pdf
- https://www.careerfirst.lk/sites/default/files/webform/cv/hot-copy-paste-7-crack.pdf
- https://cscases.com/bualisinabooksinurdupdf129-extra-quality/
- https://formyanmarbymyanmar.com/upload/files/2022/07/S2lQFX8HLWbds3NR2zVU_02_25085280eb9a493a5763dd04ee08d208_file.pdf
- https://livesound.store/wp-content/uploads/2022/07/adobe_fireworks_cs6_amtlibdll_fixed_crack.pdf
- https://www.reperiohumancapital.com/system/files/webform/ulrperv804.pdf
- http://www.camptalk.org/wp-content/uploads/2022/07/Download_Terjemah_Kitab_Ar_Ruh_P.pdf
- https://wasshygiene.com/solucionariostewart6edicionpares/
- http://bukitaksara.com/?p=7850
- https://wormenhotel.nl/wp-content/uploads/2022/07/gianlaty.pdf
- https://waappitalk.com/upload/files/2022/07/Rpi9JMfbsT5swjoeNpak_02_25085280eb9a493a5763dd04ee08d208_file.pdf
- http://www.oscarspub.ca/crack-simulador-turismo-carretera-rar-install/
- https://whatchats.com/upload/files/2022/07/Ur4LczJsGkmBMQ2j12FD_02_25085280eb9a493a5763dd04ee08d208_file.pdf
- https://www.careerfirst.lk/sites/default/files/webform/cv/daryzeli859.pdf
- http://www.tcpdf.org
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/mm/
- http://www.aiim.org/pdfa/ns/extension/
- http://www.aiim.org/pdfa/ns/schema#
- http://www.aiim.org/pdfa/ns/property#
- http://www.aiim.org/pdfa/ns/id/
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off0000170a.bindb1c58b1c0ed7624b9711c2fbfe9a6d086ccec862e4aff960158a2e6e27093fd |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x170A | 120652 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.