MALICIOUS
74
Risk Score
Machine Learning
- Nyx PDF Classifier clean score 0.0005
Heuristics 4
-
Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARMPDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://mydrugdir.com/framed.Z2VvbWV0ZXJzIHNrZXRjaHBhZCA1IGNyYWNrZ2V?freshening=bruchetta.looters.ZG93bmxvYWR8aFoxTnpWc2VIeDhNVFkxTnpBMk56RTFOSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA.jesters.orbicularis/shoutcast PDF link annotation
- https://themindfulpalm.com/pussycat-dolls-buttons-1080p-torrent-high-quality/In PDF document text
- https://volektravel.com/my-screen-recorder-pro-5-best-crack-activation-key-2020/In PDF document text
- https://www.greatescapesdirect.com/2022/07/full-solucionario-mecanica-de-materiales-robert-fitzgerald-_best_/In PDF document text
- https://dunstew.com/advert/hd-online-player-bajrangi-bhaijaan-4-full-movie-downl-install/In PDF document text
- https://www.townofwestport.org/sites/g/files/vyhlif6051/f/pages/road_improvements_newsletter_-_week_of_july_4_2022.pdfIn PDF document text
- https://hominginportland.com/city-car-driving-simulator-1-3-1-crack-portable/In PDF document text
- https://slab-bit.com/wp-content/uploads/2022/07/hilaway.pdfIn PDF document text
- https://sauvage-atelier.com/advert/initial-d-extreme-stage-pc-game-309-upd/In PDF document text
- https://www.greatescapesdirect.com/2022/07/daemon-tools-lite-10-11-crack-work-with-serial-key-2020/In PDF document text
- http://demo.funneldrivenroi.com/council/upload/files/2022/07/u4kB8pX4P3LxVMWCbt6I_06_e8840a6c5aea7a10c6d2d2d8592a78b7_file.pdfIn PDF document text
- http://findmallorca.com/el-blancoel-amarillo-y-el-negrocastellano-spanish-dvd-rip-xvid-23-install/In PDF document text
- https://belz-elektromagie.de/2022/07/06/phototomesh-7-0-4-0-win-repack/In PDF document text
- https://alumni.armtischool.com/upload/files/2022/07/MzKaEq5gtTPrYDU5wOvc_06_e8840a6c5aea7a10c6d2d2d8592a78b7_file.pdfIn PDF document text
- https://www.symonsgroup.co.nz/system/files/webform/job_applications/renaden282.pdfIn PDF document text
- http://www.studiofratini.com/hd-online-player-naruto-shippuden-movie-5-blood-priso-best/In PDF document text
- https://chihemp.com/wp-content/uploads/2022/07/After_Effects_Cs5_Warp_Stabilizer_Plugin_Free_Downloadl-1.pdfIn PDF document text
- http://naturopathworld.com/?p=2703In PDF document text
- http://otec.vlibro.cl/blog/index.php?entryid=3461In PDF document text
- https://s4academy.s4ds.com/blog/index.php?entryid=3514In PDF document text
- http://wadimakkah.co/blog/index.php?entryid=4592In PDF document text
- https://www.greatescapesdirect.com/2022/07/full-solucionario-mecanica-de-materiales-robert-In PDF document text
- https://www.townofwestport.org/sites/g/files/vyhlif6051/f/pages/road_improvements_newsletter_-_weIn PDF document text
- https://www.greatescapesdirect.com/2022/07/daemon-tools-lite-10-11-crack-work-with-serial-In PDF document text
- http://demo.funneldrivenroi.com/council/upload/files/2022/07/u4kB8pX4P3LxVMWCbt6I_06_e8840a6In PDF document text
- https://alumni.armtischool.com/upload/files/2022/07/MzKaEq5gtTPrYDU5wOvc_06_e8840a6c5aea7a1In PDF document text
- https://chihemp.com/wp-In PDF document text
- http://mydrugdir.com/framed.z2vvbwv0zxjzihnrzxrjahbhzca1ignyywnrz2v?freshening=bruchetta.looters.zg93bmxvywr8afoxtnpwc2viedhnvfkxtnpbmk56rtfoshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda.jesters.orbicularis/shoutcastIn PDF document text
- http://www.tcpdf.orgIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000035b7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x35B7 | 84508 bytes |
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c |
|||
font_01_sfnt_off0000bda3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xBDA3 | 83036 bytes |
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.