MALICIOUS
264
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF document functions as a link farm, advertising cracked software and redirecting users to download sites. The primary lure involves fake Adobe Photoshop installers, with numerous URLs pointing to potentially malicious or deceptive download gateways. The document's structure and content strongly suggest a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier clean score 0.0005
Heuristics 8
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LUREPDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
-
Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARMPDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
-
PDF links to a cracked-software download doorway (base64-obfuscated) high PDF_CRACKED_SOFTWARE_DOWNLOAD_DOORWAYPDF's embedded link hides a pirated-software title as a base64 blob inside the URL path/query (and/or carries the ``download|`` doorway-template marker), rather than in visible text. This is a TCPDF-generated SEO doorway that ranks for software-piracy searches and funnels users to fake 'crack/keygen' download pages distributing adware, potentially-unwanted programs, or droppers. The base64 encoding is deliberate obfuscation to evade plaintext lure rules; the PDF itself carries no parser exploit — the risk is the linked crack-download destination.
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://lehmanbrotherbankruptcy.com/bowsher/descendent/waterfront.QWRvYmUgUGhvdG9zaG9wIDIwMjIgKFZlcnNpb24gMjMuMSkQWR/guestroom/illiteracy/ZG93bmxvYWR8bXo1T1dkcmVIeDhNVFkxTmprNE1UVXdOSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA.overworked.allodynia PDF link annotation
- https://vincyaviation.com/wp-content/uploads/2022/07/Photoshop_2022_Version_2302.pdfIn PDF document text
- https://fermencol.ru/wp-content/uploads/2022/07/adobe_photoshop_2020_version_21_serial_key__serial_key.pdfIn PDF document text
- https://educafy.app/wp-content/uploads/2022/07/Adobe_Photoshop_CC_2018_Keygen_Crack_Serial_Key__Free_Download_2022.pdfIn PDF document text
- https://ecoganesh.com/wp-content/uploads/2022/07/ellyilyn.pdfIn PDF document text
- https://unsk186.ru/wp-content/uploads/Photoshop_2021_Version_2242_Crack__Serial_Number__Free_3264bit.pdfIn PDF document text
- https://www.giantgotrip.com/wp-content/uploads/2022/07/Adobe_Photoshop_2021_Crack_Keygen__Updated2022.pdfIn PDF document text
- https://dawnintheworld.net/wp-content/uploads/2022/07/faegent.pdfIn PDF document text
- https://taavistea.com/wp-content/uploads/2022/07/Photoshop_CC_2019_WinMac_Latest.pdfIn PDF document text
- https://mighty-eyrie-21446.herokuapp.com/fernjam.pdfIn PDF document text
- https://agrojdelnorte.com/wp-content/uploads/2022/07/Photoshop_2021_Version_223.pdfIn PDF document text
- https://enigmatic-shore-11049.herokuapp.com/Adobe_Photoshop_2021_version_22.pdfIn PDF document text
- https://fathomless-beach-04071.herokuapp.com/Adobe_Photoshop_2021_Version_2231.pdfIn PDF document text
- https://obscure-wave-13409.herokuapp.com/Photoshop_2021_version_22.pdfIn PDF document text
- https://shielded-plains-64245.herokuapp.com/Photoshop_2021_version_22.pdfIn PDF document text
- http://theartdistrictdirectory.org/wp-content/uploads/2022/07/ranalea.pdfIn PDF document text
- https://fennylaw.com/wp-content/uploads/2022/07/Adobe_Photoshop_CC_2015.pdfIn PDF document text
- https://fast-everglades-60371.herokuapp.com/jawmarj.pdfIn PDF document text
- https://guarded-caverns-30723.herokuapp.com/Photoshop_2021_Version_2200.pdfIn PDF document text
- https://murmuring-hamlet-37613.herokuapp.com/Photoshop_2022_.pdfIn PDF document text
- http://tirupatilist.com/wp-content/uploads/2022/07/Photoshop_2022_Version_2341_Activation_Download.pdfIn PDF document text
- https://whispering-shelf-10023.herokuapp.com/Photoshop_2022_Version_2301.pdfIn PDF document text
- https://desolate-oasis-69304.herokuapp.com/jaedwanb.pdfIn PDF document text
- https://lovely-channel-islands-57288.herokuapp.com/Adobe_Photoshop_2021_Version_2241.pdfIn PDF document text
- https://infinite-gorge-49876.herokuapp.com/ellwany.pdfIn PDF document text
- https://vincyaviation.com/wp-In PDF document text
- https://fermencol.ru/wp-content/uploads/2022/07/adobe_photoshop_20In PDF document text
- https://educafy.app/wp-content/uploads/2022/07/Adobe_Photoshop_CCIn PDF document text
- https://unsk186.ru/wp-content/uploads/Photoshop_2021_Version_2242_In PDF document text
- https://www.giantgotrip.com/wp-content/uploads/2022/07/Adobe_PhotoIn PDF document text
- https://taavistea.com/wp-In PDF document text
- https://agrojdelnorte.com/wp-In PDF document text
- https://enigmatic-In PDF document text
- https://fathomless-beach-04071.herokuapp.com/Adobe_Photoshop_202In PDF document text
- https://obscure-In PDF document text
- https://shielded-In PDF document text
- http://theartdistrictdirectory.org/wp-In PDF document text
- https://fennylaw.com/wp-In PDF document text
- https://guarded-In PDF document text
- http://tirupatilist.com/wp-content/uploads/2022/07/Photoshop_2022_VeIn PDF document text
- https://whispering-In PDF document text
- https://lovely-channel-islands-57288.herokuapp.com/Adobe_PhotoshopIn PDF document text
- http://lehmanbrotherbankruptcy.com/bowsher/descendent/waterfront.qwrvymugughvdg9zag9widiwmjigkfzlcnnpb24gmjmumskqwr/guestroom/illiteracy/zg93bmxvywr8bxo1t1dkcmviedhnvfkxtmprne1uvxdoshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda.overworked.allodyniaIn PDF document text
- https://trello.com/c/HD6uhXn6/110-photoshop-2022-version-231-keygen-x64-updated-2022In PDF document text
- http://compworkpdel.yolasite.com/resources/Adobe-Photoshop-2021-Version-223-HACK---Free-Download-MacWin.pdfIn PDF document text
- http://prolconpe.yolasite.com/resources/Photoshop-2021-Version-2243-Keygen-Full-Version.pdfIn PDF document text
- https://paysurtheuprop.wixsite.com/gesbizeken/post/adobe-photoshop-cc-2015-version-16-keygen-generator-activator-pc-windowsIn PDF document text
- https://trello.com/c/UKHJQHmx/52-photoshop-2021-version-2242-full-version-for-windowsIn PDF document text
- https://wakelet.com/wake/UNjsWCsyen-mSnfhtDn4xIn PDF document text
- http://www.tcpdf.orgIn PDF document text
+15 more URL(s)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003d77.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3D77 | 84760 bytes |
SHA-256: ee4610c2531ed2692c577aabd1760bba0df97392f1c9ebdda842a4b0302c7f54 |
|||
font_01_sfnt_off0000c626.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC626 | 83036 bytes |
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.