MALICIOUS
64
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.001 PowerShell
T1204.002 Malicious Link
The PDF file contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. One of the primary external links points to http://evacdir.com/harlet/cisterns, which is likely a malicious domain used for distributing further payloads or phishing. The presence of numerous links suggests an attempt to manipulate search engine results or to serve as a link farm for malicious content.
Machine Learning
- Nyx PDF Classifier clean score 0.0480
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://evacdir.com/harlet/cisterns?VG9wb0Z1c2lvbiBCYXNpYwVG9=ZG93bmxvYWR8SHI4TlhKdmRueDhNVFkxTkRZME16TTFNSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA.genuineness&procore.netbilling=sponsorship
- https://www.fourwheels.it/wp-content/uploads/2022/06/westsade.pdf
- https://rabota-ya.ru/wp-content/uploads/2022/06/toncut.pdf
- http://www.abbotsfordtoday.ca/wp-content/uploads/2022/06/HotPixelDetector__Crack__Download_For_PC.pdf
- https://captainseduction.fr/wp-content/uploads/2022/06/JShown_Crack__Incl_Product_Key_WinMac_Updated.pdf
- https://l1.intimlobnja.ru/supernova-sitemap-generator-crack/
- http://eventaka.com/?p=2689
- http://fasbest.com/?p=25472
- https://www.shankari.net/2022/06/08/logmx-free-download-latest-2022/
- https://www.netcolf.it/wp-content/uploads/2022/06/Some_Text_to_PDF_Converter.pdf
- https://richonline.club/upload/files/2022/06/OB9OoSP7uxnQClGzMNsj_08_c74acf2c7a95f80c90b5dec99e7e2eb4_file.pdf
- http://dragonsecho.com/?p=2626
- https://chatredaneshmarket.com/wp-content/uploads/2022/06/harcahi.pdf
- http://fasbest.com/?p=25474
- https://unmown.com/upload/files/2022/06/OfzogMYHIFul7OrVhAWg_08_dc01938bb4c0fbe4c0a444b915d74d75_file.pdf
- https://sissycrush.com/upload/files/2022/06/8NxNQOEP7t8rzHVZuY9l_08_dc01938bb4c0fbe4c0a444b915d74d75_file.pdf
- http://dox.expert/?p=15067
- https://ratucnc.com/syncfolders-crack-x64-latest/
- https://wilpampnamenre.wixsite.com/korjekone/post/convert-multiple-pdf-files-to-ms-word-documents-crack-incl-product-key-download
- https://muzzretinaciceraph.wixsite.com/gabreafaring/post/my-progress-bar-crack-free-download-for-windows
- https://gainvestwp.s3.us-east-2.amazonaws.com/wp-content/uploads/2022/06/07213839/Freezer_Web_Access.pdf
- http://www.tcpdf.org
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/mm/
- http://www.aiim.org/pdfa/ns/extension/
- http://www.aiim.org/pdfa/ns/schema#
- http://www.aiim.org/pdfa/ns/property#
- http://www.aiim.org/pdfa/ns/id/
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off00002475.bina217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4 |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x2475 | 120140 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.