MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF document contains a link farm advertising cracked software, with multiple external URLs pointing to such content. The primary URL, http://evacdir.com/bmZwYSA0OTcgcGRmIGZyZWUgZG93bmxvYWQbmZ/ZG93bmxvYWR8RTlrTm01MmEzeDhNVFkxTkRjNE1EZzNPWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA.adorns?&helminthic=holstering&descision=neeps, is particularly suspicious and likely serves as a gateway to malicious payloads. The document's structure and content strongly suggest a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier clean score 0.0112
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://evacdir.com/bmZwYSA0OTcgcGRmIGZyZWUgZG93bmxvYWQbmZ/ZG93bmxvYWR8RTlrTm01MmEzeDhNVFkxTkRjNE1EZzNPWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA.adorns?&helminthic=holstering&descision=neeps PDF link annotation
- https://madreandiscovery.org/fauna/checklists/checklist.php?clid=19810In PDF document text
- https://bestoffers-online.com/wp-content/uploads/2022/06/Sound_Forge_Pro_11_Serial_Number_Crack_Keygen_Download_LINK.pdfIn PDF document text
- https://sharingourwealth.com/social/upload/files/2022/06/tYhuuDYIEc9vcvgujrM7_10_fe7725d4f0a046c574492b4c63a6c1fe_file.pdfIn PDF document text
- https://flaxandthimble.com/wp-content/uploads/2022/06/haydelli.pdfIn PDF document text
- https://www.waefler-hufbeschlag.ch/wp-content/uploads/2022/06/Ontrack_EasyRecovery_Professional_V61202_RH_Keygen.pdfIn PDF document text
- https://allthingsblingmiami.com/?p=28575In PDF document text
- https://travelfamilynetwork.com/wp-content/uploads/2022/06/Bitwar_IPhone_Data_Recovery_LINK.pdfIn PDF document text
- https://pneuscar-raposo.com/eacricket07strokevariationpatchv12/In PDF document text
- https://thenationalreporterng.com/acronis-true-image-2017-20-0-build-8053-activator-crack/In PDF document text
- https://logocraticacademy.org/windows-kms-activator-ultimate-2019-4-9-latest/In PDF document text
- https://www.habkorea.net/wp-content/uploads/2022/06/Artlantis_studio_418_64_bit_crack.pdfIn PDF document text
- https://www.latablademultiplicar.com/?p=3362In PDF document text
- https://arseducation.com/ateilla-professional-id-card-maker/In PDF document text
- https://www.grenobletrail.fr/wp-content/uploads/2022/06/sakumart.pdfIn PDF document text
- https://sokhanedoost.com/fastgsm-bcm-flasher-10033-mediafire-fixed-free-17/In PDF document text
- https://social.arpaclick.com/upload/files/2022/06/CEZGIv9ucemLtqWIMqW3_10_1019e1ca54f91124583d52d2f7528785_file.pdfIn PDF document text
- https://www.iroschool.org/wp-content/uploads/2022/06/KaraokeKanta_7_0_Crack_Full_Version.pdfIn PDF document text
- https://www.campingcar.ch/advert/panda-dome-premium-18-upd-crack/In PDF document text
- https://undergroundfrequency.com/upload/files/2022/06/G6q3cENs1OYC9C2neEXf_10_fe7725d4f0a046c574492b4c63a6c1fe_file.pdfIn PDF document text
- https://bestoffers-online.com/wp-In PDF document text
- https://sharingourwealth.com/social/upload/files/2022/06/tYhuuDYIEc9vcvgujrM7_10_fe7725d4f0a046c574492b4c63a6In PDF document text
- https://www.waefler-hufbeschlag.ch/wp-In PDF document text
- https://social.arpaclick.com/upload/files/2022/06/CEZGIv9ucemLtqWIMqW3_10_1019e1ca54f91124583d52d2f752878In PDF document text
- https://undergroundfrequency.com/upload/files/2022/06/G6q3cENs1OYC9C2neEXf_10_fe7725d4f0a046c574492b4c63In PDF document text
- https://bestoffers-online.com/wp-content/uploads/2022/06/sound_forge_pro_11_serial_number_crack_keygen_download_link.pdfIn PDF document text
- https://fiverryourparty.wpcomstaging.com/wp-content/uploads/2022/06/yalikeig.pdfIn PDF document text
- http://www.tcpdf.orgIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign:
secureserver.net
1471 samples
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_002_off0000196f.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x196F | 120140 bytes |
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4 |
|||
stream_009_off0001ba93.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x1BA93 | 119072 bytes |
SHA-256: df221e87b81d1531cafdadb6c09a602e9f604d1baf0a17bbd350cbb83baa06f7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.