MALICIOUS
134
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of external links, many of which are designed to appear as downloadable files. Several heuristics indicate that these links are part of a link farm advertising cracked and pirated software. The primary goal appears to be directing users to download malicious or unwanted software disguised as legitimate cracked applications.
Machine Learning
- Nyx PDF Classifier clean score 0.0077
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINKPDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://starsearchtool.com/claves/bushbucks/precursors/ZG93bmxvYWR8SDZyTnpreGFYeDhNVFkxTmpnNU1qTTFNbng4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk/&scorcher=dentis&turnout=R3JlZW5maXNoIERhdGFNaW5lcgR3J PDF link annotation
- https://tgmcn.com/extreme-music-manager-1-3-1-download-for-windows-april-2022/In PDF document text
- https://community.thecityhubproject.com/upload/files/2022/07/wvNnkGaT79i4b3zKcSgw_04_0d65bf94c75ae8430503803caa941867_file.pdfIn PDF document text
- https://www.moultonboroughnh.gov/sites/g/files/vyhlif3506/f/uploads/those_serving_our_country_13.pdfIn PDF document text
- https://ratucnc.com/wp-content/uploads/2022/07/tomdas.pdfIn PDF document text
- https://ig-link.com/star-pdf-watermark-ultimate-2-0-1-crack-win-mac/In PDF document text
- https://www.husebyautodeler.no/sites/default/files/webform/alomware-lights.pdfIn PDF document text
- https://loveandhappiness.tv/easy2convert-raw-to-jpg-pro-crack-free-license-key-latest/In PDF document text
- http://youngcreativeschool.com/wp-content/uploads/2022/07/CryptoStuff_Crack_Keygen_Full_Version_Free_3264bit_Updated.pdfIn PDF document text
- https://attitude.ferttil.com/upload/files/2022/07/8PlgdwiSAbL6BdTTaXqc_04_e3fea1ebd2f97266d950e61d92483549_file.pdfIn PDF document text
- http://www.ambulatorioveterinarioiaccarino.it/wp-content/uploads/2022/07/brydray.pdfIn PDF document text
- https://techessay.org/html-guardian-decrypter-crack-x64/In PDF document text
- http://www.gnsolutions.ph/sites/default/files/webform/CloudViewNMS.pdfIn PDF document text
- http://www.casadanihotel.com/?p=13330In PDF document text
- http://eventaka.com/?p=25329In PDF document text
- https://www.veronicaandersonjewellery.co.za/sites/default/files/webform/large-files-and-folders-finder.pdfIn PDF document text
- https://libertycentric.com/upload/files/2022/07/vOBXENLz9ylRSj88jBgD_04_e5099e6c3a1f9a3bb2796177a47d1905_file.pdfIn PDF document text
- https://cambodiaonlinemarket.com/myeclipse-enterprise-workbench-formerly-mobione-design-center-6-7-6-0-crack-license-key-full-download-latest-2022/In PDF document text
- https://gjurmet.com/wp-content/uploads/2022/07/zakazer.pdfIn PDF document text
- http://duhocnewworld.com/wp-content/uploads/2022/07/Scrapbook_Crack__Download_X64_Latest_2022.pdfIn PDF document text
- https://community.thecityhubproject.com/upload/files/2022/07/wvNnkGaT79i4b3zKcSgw_04_0d65bf9In PDF document text
- https://www.moultonboroughnh.gov/sites/g/files/vyhlif3506/f/uploads/those_serving_our_country_13In PDF document text
- http://youngcreativeschool.com/wp-In PDF document text
- https://attitude.ferttil.com/upload/files/2022/07/8PlgdwiSAbL6BdTTaXqc_04_e3fea1ebd2f97266d950eIn PDF document text
- https://www.veronicaandersonjewellery.co.za/sites/default/files/webform/large-files-and-folders-In PDF document text
- https://libertycentric.com/upload/files/2022/07/vOBXENLz9ylRSj88jBgD_04_e5099e6c3a1f9a3bb2796In PDF document text
- https://cambodiaonlinemarket.com/myeclipse-enterprise-workbench-formerly-mobione-design-In PDF document text
- http://duhocnewworld.com/wp-In PDF document text
- http://duhocnewworld.com/wp-content/uploads/2022/07/scrapbook_crack__download_x64_latest_2022.pdfIn PDF document text
- https://wakelet.com/wake/a7dJVKnUbEhHl5eR1lXoOIn PDF document text
- http://www.tcpdf.orgIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign:
secureserver.net
1471 samples
Open this report in the interactive analyzer, or submit your own file for analysis.