MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF document contains a large number of external links, many of which advertise cracked software. One of the extracted URLs, http://mydrugdir.com/attributed/correxion?..., is directly associated with a heuristic firing indicating an external URI. This suggests the document is designed to redirect users to potentially malicious download sites.
Machine Learning
- Nyx PDF Classifier clean score 0.0066
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://mydrugdir.com/attributed/correxion?ZG93bmxvYWR8SVg2WTI5NlpYeDhNVFkxTnpBMk56RTFOSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA=VXMgcGF0ZW50IG5vcyA0NjAzIGRyaXZlciBkb3dubG9hZAVXM&austin=fusss.methylmercury&heliotropine=mistinguett PDF link annotation
- https://www.cameraitacina.com/en/system/files/webform/feedback/crack-aft-fathom-1001103-build-20180612-full-with-medicinebabupc.pdfIn PDF document text
- https://thelacypost.com/epubor-audible-converter-crack-with-license-key-free-extra-quality/In PDF document text
- https://www.place-corner.com/three-kingdoms-legends-of-heroes-crack-activation-code-free/In PDF document text
- https://voiccing.com/upload/files/2022/07/Rnbh6rtaOXuuUUrtiWOR_06_fadea998b49813ff29dd06e12ec16ec5_file.pdfIn PDF document text
- https://24hairnow.com/wp-content/uploads/2022/07/HyperDot_PC_Game_Free_Download.pdfIn PDF document text
- https://bitcointrading.se/?p=7875In PDF document text
- http://beepublishing.nl/2022/07/06/bhool-bhulaiyaa-2007-720p-bluray-x264-ac3-51-esubs-download-fixhubmkv/In PDF document text
- https://www.cameraitacina.com/en/system/files/webform/feedback/el-origen-de-la-vida-antonio-lazcano-pdf-download.pdfIn PDF document text
- https://www.ekifoods.com/wp-content/uploads/2022/07/List_Of_Games_That_Work_On_Cracked_Steam_High_Quality-1.pdfIn PDF document text
- https://www.kitteryme.gov/sites/g/files/vyhlif3316/f/uploads/appointment_application_for_town_boards_-_january_2021-_fillable.pdfIn PDF document text
- https://rebatecircle.com/wp-content/uploads/2022/07/subtitles_game_of_thrones_s03e07720p_hdtv_x2642hd.pdfIn PDF document text
- https://passaportebrasileirousa.com/stellar-phoenix-sql-database-repair-v8-15-10-verified-crack-full-version/In PDF document text
- https://big-plate.de/2022/07/06/pengantar-ilmu-politik-miriam-budiardjo-pdf-download-upd/In PDF document text
- https://cuteteddybearpuppies.com/2022/07/autodesk-autocad-2010-keygens-only-x-force-32-64bits-rh-download-link-pcbfdcm/In PDF document text
- https://descargatelo.net/pc/cloud/komik-tinju-bintang-utara-pdf-download-exclusive/In PDF document text
- http://www.aceportocolom.org/wp-content/uploads/2022/07/Adobe_Acrobat_XI_Pro_1101_Multilanguage_ChingLiu_Serial_Key.pdfIn PDF document text
- http://rbics.net/?p=3504In PDF document text
- https://ideaboz.com/wp-content/uploads/2022/07/khrgal.pdfIn PDF document text
- https://www.warwicktownship.org/sites/g/files/vyhlif5151/f/u136/forge_the_future_2022_final_plan.pdfIn PDF document text
- https://www.cameraitacina.com/en/system/files/webform/feedback/craIn PDF document text
- https://thelacypost.com/epubor-audible-converter-crack-with-license-In PDF document text
- https://www.place-corner.com/three-kingdoms-legends-of-heroes-In PDF document text
- https://voiccing.com/upload/files/2022/07/Rnbh6rtaOXuuUUrtiWOR_06In PDF document text
- https://24hairnow.com/wp-In PDF document text
- http://beepublishing.nl/2022/07/06/bhool-bhulaiyaa-2007-720p-bluray-In PDF document text
- https://www.cameraitacina.com/en/system/files/webform/feedback/el-In PDF document text
- https://www.ekifoods.com/wp-content/uploads/2022/07/List_Of_GamesIn PDF document text
- https://www.kitteryme.gov/sites/g/files/vyhlif3316/f/uploads/appointmeIn PDF document text
- https://rebatecircle.com/wp-content/uploads/2022/07/subtitles_game_In PDF document text
- https://passaportebrasileirousa.com/stellar-phoenix-sql-database-In PDF document text
- https://big-plate.de/2022/07/06/pengantar-ilmu-politik-miriam-In PDF document text
- https://cuteteddybearpuppies.com/2022/07/autodesk-autocad-2010-keIn PDF document text
- https://descargatelo.net/pc/cloud/komik-tinju-bintang-utara-pdf-In PDF document text
- http://www.aceportocolom.org/wp-content/uploads/2022/07/Adobe_AcrIn PDF document text
- https://www.warwicktownship.org/sites/g/files/vyhlif5151/f/u136/forge_In PDF document text
- https://emealjobs.nttdata.com/pt-pt/system/files/webform/ellihyr811.pdfIn PDF document text
- http://www.tcpdf.orgIn PDF document text
- https://emealjobs.nttdata.com/pt-In PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign:
secureserver.net
1471 samples
Open this report in the interactive analyzer, or submit your own file for analysis.