MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of external links, many of which point to PDFs advertising cracked software, such as Photoshop CS6. The PDF_URI heuristic also identified a remote GoTo action, indicating the document is designed to redirect the user to external content. The primary goal appears to be driving traffic to these software-luring sites.
Machine Learning
- Nyx PDF Classifier clean score 0.0153
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
Remote GoTo action info PDF_GOTO_REMOTEPDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://dormister.com/benecke/ZG93bmxvYWR8M1JFT1dRMmRIeDhNVFkxTmprNE1UVXdOSHg4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk/choosing/clonic/?wright.UGhvdG9zaG9wIENDIDIwMTUUGh&epstein=fairbanks PDF link annotation
- https://www.gift4kids.org/wp-content/uploads/2022/07/sanwas.pdfIn PDF document text
- https://calm-beach-06248.herokuapp.com/yedfar.pdfIn PDF document text
- https://sheltered-falls-08025.herokuapp.com/creavir.pdfIn PDF document text
- http://wikicando.com/wp-content/uploads/Photoshop_CS6_universal_keygen___Download_PCWindows.pdfIn PDF document text
- https://calm-bastion-36228.herokuapp.com/Photoshop_2022_Version_231.pdfIn PDF document text
- https://shrouded-tor-10430.herokuapp.com/alfthor.pdfIn PDF document text
- https://mighty-hamlet-30013.herokuapp.com/Photoshop_2021_Version_222.pdfIn PDF document text
- https://secure-savannah-29256.herokuapp.com/Adobe_Photoshop_CC_2019_version_20.pdfIn PDF document text
- https://mighty-waters-80382.herokuapp.com/jarhal.pdfIn PDF document text
- https://lordwillprovide.com/wp-content/uploads/2022/07/Adobe_Photoshop_CC_2015_Version_16_Activation_Code_With_Keygen_Free_For_PC_Latest.pdfIn PDF document text
- https://travelsarkar.com/wp-content/uploads/2022/07/chejai.pdfIn PDF document text
- https://brandyallen.com/wp-content/uploads/2022/07/Photoshop_2021_version_22_keygenexe__With_Serial_Key_Free_MacWin_Updated_2022.pdfIn PDF document text
- https://conexionfit.net/wp-content/uploads/2022/07/henrbalf.pdfIn PDF document text
- https://peaceful-cove-03059.herokuapp.com/caszave.pdfIn PDF document text
- https://undergroundstudio.it/wp-content/uploads/2022/07/kalhar.pdfIn PDF document text
- https://seo-focus.com/wp-content/uploads/2022/07/Photoshop_2020.pdfIn PDF document text
- https://4healthynature.com/wp-content/uploads/2022/07/randjael.pdfIn PDF document text
- https://www.zmiksowane.com/wp-content/uploads/2022/07/manttong.pdfIn PDF document text
- https://secretcs2020.com/wp-content/uploads/2022/07/amadgran.pdfIn PDF document text
- https://cuteteddybearpuppies.com/wp-content/uploads/2022/07/dorwes.pdfIn PDF document text
- https://sleepy-ridge-49166.herokuapp.com/Adobe_Photoshop_CC.pdfIn PDF document text
- http://eastleeds.online/wp-content/uploads/2022/07/baldkae.pdfIn PDF document text
- https://stormy-escarpment-53460.herokuapp.com/jamvoj.pdfIn PDF document text
- https://jovenesvip.com/wp-content/uploads/2022/07/counyane.pdfIn PDF document text
- https://shipping200.com/wp-content/uploads/2022/07/Photoshop_2022_Version_2302.pdfIn PDF document text
- http://www.gea-pn.it/wp-content/uploads/2022/07/Photoshop_2022_Version_230.pdfIn PDF document text
- http://wikicando.com/wp-In PDF document text
- https://lordwillprovide.com/wp-content/uploads/2022/07/Adobe_Photoshop_CC_2015_Version_16_ActivIn PDF document text
- https://brandyallen.com/wp-content/uploads/2022/07/Photoshop_2021_version_22_keygenexe__With_In PDF document text
- http://wikicando.com/wp-content/uploads/photoshop_cs6_universal_keygen___download_pcwindows.pdfIn PDF document text
- https://wakelet.com/wake/PA6SFqzOhUx_skSy5CxUsIn PDF document text
- https://wakelet.com/wake/Q3wU9b2-2XOzzpvWG6UJjIn PDF document text
- https://wakelet.com/wake/RXQ21O4Khx26Rei8XST5hIn PDF document text
- http://www.tcpdf.orgIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
Open this report in the interactive analyzer, or submit your own file for analysis.