MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF document contains a large number of external links, many of which advertise cracked software, indicating a lure to download malicious files. The heuristic 'PDF_SEO_LINK_FARM' and 'PDF_CRACKED_SOFTWARE_LURE' strongly suggest this malicious intent. The embedded URLs are likely used to host or redirect to malware payloads.
Machine Learning
- Nyx PDF Classifier clean score 0.0072
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://emailgoal.com/kepuhi/ZG93bmxvYWR8OHF5TW10aWVueDhNVFkxTnpBek5qSXlNM3g4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/RmlmYSAyMgRml/maitia.afterbirth?implants=/pumps/ PDF link annotation
- https://movingservices.us/index.php/2022/07/05/fifa-22-crack-file-only-free-download/In PDF document text
- http://negarshop.ir/fifa-22-keygen-march-2022/In PDF document text
- http://www.tampabestplaces.com/wp-content/uploads/2022/07/Fifa_22_Free.pdfIn PDF document text
- https://www.customwizard.com.au/sites/default/files/webform/Fifa-22_23.pdfIn PDF document text
- http://www.chandabags.com/fifa-22-for-windows/In PDF document text
- https://www.yflyer.org/advert/fifa-22-crack-full-version-download-for-pc/In PDF document text
- https://geto.space/upload/files/2022/07/h8MGzujaggB8VdYa9I5O_05_1dc94093143ace779c7c9a1eeb09f92d_file.pdfIn PDF document text
- http://oag.uz/?p=29107In PDF document text
- https://socialstudentb.s3.amazonaws.com/upload/files/2022/07/9STLCVlTcXpiHuv5CKGM_05_1dc94093143ace779c7c9a1eeb09f92d_file.pdfIn PDF document text
- https://suchanaonline.com/fifa-22-serial-number-and-product-key-crack-license-key-download-2022/In PDF document text
- https://versiis.com/40781/fifa-22-install-crack-product-key-full/In PDF document text
- https://followgrown.com/upload/files/2022/07/akpMwDHS3u3txtnTzYBE_05_2becd83093bccdb8f2be3c27c5ebacdc_file.pdfIn PDF document text
- https://afternoon-meadow-26007.herokuapp.com/stanbla.pdfIn PDF document text
- https://internationalpatientcare.narayanahealth.org/sites/default/files/webform/Fifa-22_0.pdfIn PDF document text
- https://www.lafeedulogis.ch/?p=2479In PDF document text
- https://egypt-aquarium.com/advert/fifa-22-crack-file-only-free-2022/In PDF document text
- https://www.cameraitacina.com/en/system/files/webform/feedback/fifa-22_727.pdfIn PDF document text
- http://levitra-gg.com/wp-content/uploads/2022/07/Fifa_22_Serial_Key__WinMac_Latest.pdfIn PDF document text
- http://co-creacion.mx/comparte/blog/index.php?entryid=3130In PDF document text
- https://movingservices.us/index.php/2022/07/05/fifa-22-crack-file-only-In PDF document text
- http://www.tampabestplaces.com/wp-In PDF document text
- https://www.customwizard.com.au/sites/default/files/webform/Fifa-22_2In PDF document text
- https://geto.space/upload/files/2022/07/h8MGzujaggB8VdYa9I5O_05_1dIn PDF document text
- https://socialstudentb.s3.amazonaws.com/upload/files/2022/07/9STLCVlIn PDF document text
- https://suchanaonline.com/fifa-22-serial-number-and-product-key-crack-In PDF document text
- https://followgrown.com/upload/files/2022/07/akpMwDHS3u3txtnTzYBE_In PDF document text
- https://internationalpatientcare.narayanahealth.org/sites/default/files/wIn PDF document text
- https://www.cameraitacina.com/en/system/files/webform/feedback/fifa-In PDF document text
- http://levitra-gg.com/wp-In PDF document text
- https://www.rsm.global/romania/en/system/files/webform/delavurn284.pdfIn PDF document text
- http://www.tcpdf.orgIn PDF document text
- https://www.rsm.global/romania/en/system/files/webform/delavurn284.pIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign:
secureserver.net
1471 samples
Open this report in the interactive analyzer, or submit your own file for analysis.