MALICIOUS
64
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious File
T1059.001 PowerShell
The PDF contains a significant number of external links, indicating a link farm designed to redirect users to potentially malicious websites. One of the embedded URLs, http://evacdir.com/giddiness.ZG93bmxvYWR8ajZFWm0xeGJueDhNVFkxTkRjNE1EYzROM3g4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk/espace/dGVjbm9sb2dpYSA5IGNyaXN0aW5hIGJvbmFyZGkgcGRmIGRvd25sb2FkdGV/harmonic.meisterstruck.proclear, is particularly suspicious and likely serves as a download or redirection point. The presence of a link farm heuristic strongly suggests a malware distribution or phishing campaign.
Machine Learning
- Nyx PDF Classifier clean score 0.0450
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://evacdir.com/giddiness.ZG93bmxvYWR8ajZFWm0xeGJueDhNVFkxTkRjNE1EYzROM3g4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk/espace/dGVjbm9sb2dpYSA5IGNyaXN0aW5hIGJvbmFyZGkgcGRmIGRvd25sb2FkdGV/harmonic.meisterstruck.proclear
- https://jobdahanday.com/the-angry-birds-movie-english-2-movie-tamil-dubbed-free-download/
- https://afternoon-gorge-61423.herokuapp.com/uniklyn.pdf
- http://www.hakcanotel.com/free-pixabay-photoshop-plugin-how-to-add-pixabay-photos-to-photoshop-directly/
- https://lots-a-stuff.com/forzahorizon2pccrack15/
- https://automative.club/upload/files/2022/06/6up2W7JxW9o7YPk29BGV_09_4430b10b2021d8885ff70e3cac1f84a0_file.pdf
- https://cdn.geeb.xyz/upload/files/2022/06/66xQ53X5qnMJMVPg7RfF_09_4430b10b2021d8885ff70e3cac1f84a0_file.pdf
- http://garage2garage.net/advert/tales-of-xillia-2-rpcs3-but-shit-dlcs-wont-work-on-its-platn/
- https://damp-crag-76082.herokuapp.com/gilbweb.pdf
- https://himoin.com/upload/files/2022/06/ZUuV8bFUPTJTrcOtEcSn_09_d6bda909c371dc614b2514e53f0270f6_file.pdf
- https://internationalbrandcreators.com/qgis-2-4-64-bit-free-new-download/
- https://freetalkusa.app/upload/files/2022/06/XMTOUciA5ThsMhs5btRy_09_4430b10b2021d8885ff70e3cac1f84a0_file.pdf
- https://thebakersavenue.com/sigmakey-box-2-33-34-crack-full-activated-free-download/
- http://www.kmjgroupfitness.com/?p=11346
- https://blogup.in/upload/files/2022/06/isjAUCiT5RjtSmRLtnD4_09_d6bda909c371dc614b2514e53f0270f6_file.pdf
- https://qflash.es/?p=14595
- https://wmondemand.com/?p=6290
- https://purosautoskansas.com/?p=34327
- https://7smabu2.s3.amazonaws.com/upload/files/2022/06/8P67bdJMNwzzilwjF7gf_09_40cc1fd837343c0e1f1a790bbd0ef67d_file.pdf
- https://irootworld01.s3.amazonaws.com/upload/files/2022/06/a5fu6az5THIhZXvUuv89_09_d6bda909c371dc614b2514e53f0270f6_file.pdf
- https://ysolsovolcont.wixsite.com/repnevipu/post/roland-xc-540-printer-driversl
- http://www.tcpdf.org
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/mm/
- http://www.aiim.org/pdfa/ns/extension/
- http://www.aiim.org/pdfa/ns/schema#
- http://www.aiim.org/pdfa/ns/property#
- http://www.aiim.org/pdfa/ns/id/
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off00001a61.bina217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4 |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x1A61 | 120140 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.