MALICIOUS
149
Risk Score
Machine Learning
- Nyx PDF Classifier clean score 0.0015
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LUREPDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
-
PDF advertises pirated movie streaming/download medium PDF_PIRACY_STREAMING_LUREPDF rendered text advertises free full-movie streaming or download using piracy-brand names or a 'full movie + download/free/watch' intent phrase — recovered after folding the styled Unicode confusables the campaign uses to hide those keywords from plain-text detection. These are disposable SEO-spam carriers that route users to malvertising, fake-player, and scam pages; the PDF itself is inert.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://evacdir.com/affectionate/hindus.crept?clarinets=Q0syIERMQyBBY3RpdmF0b3IgQ29yZXBhY2sQ0s.ZG93bmxvYWR8TWI2YjJadVlueDhNVFkxTkRrNE9URTJNbng4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA&follies= PDF link annotation
- http://cancer.fund/wp-content/uploads/2022/06/Battlefield_2_aimbot_15_12.pdfIn PDF document text
- https://csermoocf6ext.blog/2022/06/13/incomedia-website-x5-professional-v18-1-5-7-multilingual-download-pc-updated/In PDF document text
- https://himoin.com/upload/files/2022/06/GMDXcqFaIyAZFvMMRK8A_12_e02a520a8ff1fdd7258183546d1500f4_file.pdfIn PDF document text
- https://sjbparishnaacp.org/wp-content/uploads/2022/06/dorquil.pdfIn PDF document text
- http://www.neorestaurantqatar.com/htc-free-unlock-codes-calculator-v2-2-fixed-rar/In PDF document text
- https://sjdistributions.com/cd-key-trainz-simulator-12-46957-serialhttps-scoutmails-com-index301-php-k-cd-key-trainz-simulator/In PDF document text
- https://www.cardinalbags.gr/?p=61956In PDF document text
- https://www.afaceripromo.ro/wp-content/uploads/2022/06/vorrigh.pdfIn PDF document text
- https://ictlife.vn/upload/files/2022/06/ZpN9auDxsWDN5j7yY2j3_13_e02a520a8ff1fdd7258183546d1500f4_file.pdfIn PDF document text
- https://facethai.net/upload/files/2022/06/4QY5sEN6LNoSU6CriXRW_12_e02a520a8ff1fdd7258183546d1500f4_file.pdfIn PDF document text
- https://together-19.com/upload/files/2022/06/CJLgOtl6Yb6hFYRxzk31_12_488cca092c51d1f1f50a22b25d8030e6_file.pdfIn PDF document text
- https://www.castingventuno.it/wp-content/uploads/2022/06/Eurocut_Basic_7_crackrar.pdfIn PDF document text
- https://ekokai.com/wp-content/uploads/2022/06/AVIA_Scan2CAD_PRO_V8_2e.pdfIn PDF document text
- https://isaiah58boxes.com/2022/06/12/vpn-unlimited-6-3-link-crack-with-license-code-free-download-2020/In PDF document text
- https://dd-school.com/wp-content/uploads/2022/06/pertjo.pdfIn PDF document text
- https://silkfromvietnam.com/wp-content/uploads/2022/06/meiele.pdfIn PDF document text
- http://www.visitmenowonline.com/upload/files/2022/06/z1Yh6YWUiwJPa69cE4Vp_12_80cbc5439ac4c48c60f6569660f5e6ce_file.pdfIn PDF document text
- https://foaclothing.com/wp-content/uploads/2022/06/ellykirs.pdfIn PDF document text
- https://72bid.com?password-protected=loginIn PDF document text
- https://www.arunachalreflector.com/wp-content/uploads/2022/06/FULL_Wondershare_Data_Recovery_60031_Crack.pdfIn PDF document text
- http://evacdir.com/affectionate/hindus.crept?clarinets=q0syiermqybby3rpdmf0b3igq29yzxbhy2sq0s.zg93bmxvywr8twi2yjjadvluedhnvfkxtkrrne9urtjnbng4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda&follies=In PDF document text
- http://www.tcpdf.orgIn PDF document text
- https://3dtoday.ru/blogs/andreas/the-lords-of-the-sparkling-diamond-deckIn PDF document text
- https://3dtoday.ru/blogs/andreas/the-lords-In PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign:
secureserver.net
1471 samples
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_002_off00000f16.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xF16 | 120140 bytes |
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4 |
|||
font_01_sfnt_off0000bcf9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xBCF9 | 76772 bytes |
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.