MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF file contains a large number of external links, many of which are advertised as cracked software. One of the primary links, http://evacdir.com/chemises/nishayam/hexaniacinate/pleuritis/cumbria?ZG93bmxvYWR8SGsxWWpJM2VIeDhNVFkxTnpFNE5qazFOWHg4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk=prfree&S3JhbnRpIDE5ODEgRHZEUmlwIHgyNjQgQUMgMyBNNzc3IE0yVHYS3J=, appears to be a malicious domain used for downloading payloads. The heuristic firings indicate a link farm designed to promote pirated software, suggesting a lure for users to download potentially malicious files.
Machine Learning
- Nyx PDF Classifier clean score 0.0452
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://evacdir.com/chemises/nishayam/hexaniacinate/pleuritis/cumbria?ZG93bmxvYWR8SGsxWWpJM2VIeDhNVFkxTnpFNE5qazFOWHg4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk=prfree&S3JhbnRpIDE5ODEgRHZEUmlwIHgyNjQgQUMgMyBNNzc3IE0yVHYS3J= PDF link annotation
- https://thehomeofheroes.org/easeus-data-recovery-12-8-crack-better-with-license-key-2019/In PDF document text
- https://tutorizone.com/wp-content/uploads/2022/07/flawjard.pdfIn PDF document text
- https://yooyi.properties/wp-content/uploads/2022/07/CounterStrike_Source_Zombie_Mod_New_Editmod_Serial_Key_Keyge.pdfIn PDF document text
- https://moniispace.com/upload/files/2022/07/SsWwPnE5fEJZ1ymlGtvK_08_a0cdc7553e87234c6045ce1f177d3015_file.pdfIn PDF document text
- http://www.studiofratini.com/pipeflow-expert-2007-rev-1-12-rar-2/In PDF document text
- http://www.rathisteelindustries.com/wp-content/uploads/2022/07/osypan.pdfIn PDF document text
- https://shielded-beyond-27101.herokuapp.com/freaelme.pdfIn PDF document text
- https://immense-ridge-83997.herokuapp.com/napoleon_bonaparte_history_in_urdu_pdf_download.pdfIn PDF document text
- https://salty-stream-77408.herokuapp.com/AUTODATA465CrackFULLUpdate2018.pdfIn PDF document text
- https://ourlittlelab.com/wp-content/uploads/2022/07/Cobra_driver_Pack_2018_ISO_Cracked_Free_Download.pdfIn PDF document text
- https://eqsport.biz/baca-novel-melayu-online-free-best/In PDF document text
- https://fairosport.com/solucionarioresistenciadematerialesschaumwilliamnash/In PDF document text
- https://lit-chamber-52114.herokuapp.com/illyvyvy.pdfIn PDF document text
- https://boiling-tundra-30132.herokuapp.com/ysolat.pdfIn PDF document text
- https://culvita.com/top-spin-1-pc-game-free-11-new/In PDF document text
- http://www.reiten-scheickgut.at/wp-content/uploads/2022/07/HD_Online_Player_grau_gmbh_video_repair_tool_keygen_17.pdfIn PDF document text
- http://oneteamacademy.com/wp-content/uploads/2022/07/Gp_Pro_Ex_Software_Free_Download.pdfIn PDF document text
- https://yooyi.properties/wp-In PDF document text
- https://moniispace.com/upload/files/2022/07/SsWwPnE5fEJZ1ymlGtvK_08_a0cdc7553e87234c6045ceIn PDF document text
- https://ourlittlelab.com/wp-In PDF document text
- http://www.reiten-scheickgut.at/wp-In PDF document text
- http://www.reiten-scheickgut.at/wp-content/uploads/2022/07/hd_online_player_grau_gmbh_video_repair_tool_keygen_17.pdfIn PDF document text
- https://wakelet.com/wake/Av2KhVu9p2vBAXmJByRCeIn PDF document text
- https://trello.com/c/IY2mS6Aq/46-originlab-9-free-download-with-crack-repackIn PDF document text
- https://trello.com/c/A1Yzv1BO/101-antrenand-o-pe-tessa-pdf-free-linkIn PDF document text
- http://www.tcpdf.orgIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign:
secureserver.net
1471 samples
Open this report in the interactive analyzer, or submit your own file for analysis.