MALICIOUS
64
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious File
The PDF document contains a significant number of external links, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The primary URL, http://evacdir.com/brahmin.ZG93bmxvYWR8QlczTm1vMmNYeDhNVFkxTkRZME16TTFNSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/V29yZGFpemVyV29?dross=festers&grout=wardour, is likely a download or redirect link. This pattern suggests the document is used to distribute malware or lead users to phishing sites.
Machine Learning
- Nyx PDF Classifier clean score 0.0145
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://evacdir.com/brahmin.ZG93bmxvYWR8QlczTm1vMmNYeDhNVFkxTkRZME16TTFNSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/V29yZGFpemVyV29?dross=festers&grout=wardour
- https://marcsaugames.com/wp-content/uploads/2022/06/MakeURL.pdf
- https://social.mactan.com.br/upload/files/2022/06/mnlbJBazRjuzTHjG6JOv_08_396797391d2c28be33d8f639f20203e4_file.pdf
- https://netbizzz.com/wp-content/uploads/2022/06/Swiff_Player_Crack_With_License_Code_Free_Download_For_PC.pdf
- https://vilabegir.com/wp-content/uploads/2022/06/Home_Planet_Full_Edition_Crack__Free_Download_X64_Updated_2022.pdf
- https://newsandfly.com/airlines/garena-password-decryptor-crack-april-2022/
- https://xn--wo-6ja.com/upload/files/2022/06/D42rSTIJkEl8jlNxhpNo_08_14416ecd33bbd7518765395b4de722f3_file.pdf
- http://angenehme-welt.de/wp-content/uploads/2022/06/PhotoShop_Redesign_Crack___MacWin.pdf
- https://aboutdance.com.ua/advert/bitfinder-crack-product-key-full-free-download-32-64bit-updated/
- https://tazzakhabar.com/2022/06/snowscape-license-key-full-free-2022/
- https://omidsoltani.ir/wp-content/uploads/2022/06/MouseMoverPro.pdf
- https://weedcottage.online/wp-content/uploads/2022/06/Portable_Presentation_Assistant_Pro.pdf
- https://n21.pl/wp-content/uploads/2022/06/JSatTrak_Crack__License_Key_Free_Download_Latest.pdf
- http://www.labonnecession.fr/wp-content/uploads/2022/06/SecurePad.pdf
- https://bikerhall.com/upload/files/2022/06/1gOe77RuxE88EGic7x6p_08_07aeed19b9c34cffd426c88a249a1ddd_file.pdf
- https://chatinzone.com/upload/files/2022/06/1bIOckANK3mHaauy28TJ_08_14416ecd33bbd7518765395b4de722f3_file.pdf
- https://www.realteqs.com/teqsplus/upload/files/2022/06/osUW5STTicYfzUYYDiSL_08_71eced0d321533490fb517fb8398b22d_file.pdf
- https://img.creativenovels.com/images/uploads/2022/06/System_Monitor_Vista_Gadget.pdf
- http://www.bankerogkontanter.no/wp-content/uploads/2022/06/belajaim.pdf
- https://netcityme.com/wp-content/uploads/2022/06/rozenan.pdf
- https://gardenstatecomedyclub.com/gimp-paint-studio-crack-with-product-key-latest-2022/
- http://www.tcpdf.org
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/mm/
- http://www.aiim.org/pdfa/ns/extension/
- http://www.aiim.org/pdfa/ns/schema#
- http://www.aiim.org/pdfa/ns/property#
- http://www.aiim.org/pdfa/ns/id/
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off00002b7b.bin7d44633472769032f30b274453090513fc2c4ce27be3b37751e0bcfcb6e53c1f |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x2B7B | 120312 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.