MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF document contains numerous external links, with several heuristics indicating a link farm designed to advertise cracked software. One of the embedded URLs, http://find24hs.com/dosha/buonanoce/feedmyipods/fruit/ZG93bmxvYWR8aGg5TVhVeGRueDhNVFkxTnpBek5qSXlNM3g4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/tatties/harmonycoaching.nicad?RmlmYSAyMgRml=, is particularly suspicious and likely serves as a download source for malicious payloads. The document body was not sufficiently readable to provide further context.
Machine Learning
- Nyx PDF Classifier clean score 0.0045
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LUREPDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://find24hs.com/dosha/buonanoce/feedmyipods/fruit/ZG93bmxvYWR8aGg5TVhVeGRueDhNVFkxTnpBek5qSXlNM3g4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/tatties/harmonycoaching.nicad?RmlmYSAyMgRml= PDF link annotation
- https://www.sunsquare.com/system/files/webform/useruploads/fifa-22_27.pdfIn PDF document text
- https://www.oakland-nj.org/sites/g/files/vyhlif1026/f/uploads/borough_calendar_2022.pdfIn PDF document text
- https://fajas.club/2022/07/05/fifa-22-mac-win-2/In PDF document text
- https://beautyprosnearme.com/fifa-22-crack-patch-x64/In PDF document text
- https://comoemagrecerrapidoebem.com/?p=23471In PDF document text
- https://1w74.com/fifa-22-crack-exe-file-free-download-mac-win-2022/In PDF document text
- https://socialstudentb.s3.amazonaws.com/upload/files/2022/07/VXTiiUV9mUdw1b5dO9JY_05_94b78d48ae2ae8bffbb8f1d33d684724_file.pdfIn PDF document text
- https://poetbook.com/upload/files/2022/07/M3HyER6b1UBng4v5Ryz1_05_94b78d48ae2ae8bffbb8f1d33d684724_file.pdfIn PDF document text
- https://fpp-checkout.net/wp-content/uploads/2022/07/aleeisa.pdfIn PDF document text
- https://mykingdomtoken.com/upload/files/2022/07/e34aKgvKQUuyrQoVFMIY_05_94b78d48ae2ae8bffbb8f1d33d684724_file.pdfIn PDF document text
- https://ictlife.vn/upload/files/2022/07/HxJMtquEKvaItDkCmFzc_05_c73db3cef1415170211b5fb97ba6a183_file.pdfIn PDF document text
- http://staffdirect.info/wp-content/uploads/2022/07/Fifa_22_Activation___Product_Key_Full_MacWin_March2022.pdfIn PDF document text
- https://geto.space/upload/files/2022/07/7ha4xzlMjaD7YYCKYfXR_05_94b78d48ae2ae8bffbb8f1d33d684724_file.pdfIn PDF document text
- http://increate.net/fifa-22-with-license-key-product-key-full-download/In PDF document text
- https://www.eclateng.com/sites/default/files/webform/Fifa-22.pdfIn PDF document text
- https://swapandsell.net/2022/07/05/fifa-22-nulled-with-full-keygen-free-download-for-pc-latest/In PDF document text
- https://parleafrique.com/wp-content/uploads/2022/07/choalo.pdfIn PDF document text
- https://affiliateschools.com/upload/files/2022/07/KhyZPYZH85orWj2VLKBp_05_c73db3cef1415170211b5fb97ba6a183_file.pdfIn PDF document text
- https://socialstudentb.s3.amazonaws.com/upload/files/2022/07/VXTiiUV9mUdw1b5dO9JY_05_94b78dIn PDF document text
- https://poetbook.com/upload/files/2022/07/M3HyER6b1UBng4v5Ryz1_05_94b78d48ae2ae8bffbb8f1dIn PDF document text
- https://mykingdomtoken.com/upload/files/2022/07/e34aKgvKQUuyrQoVFMIY_05_94b78d48ae2ae8bffIn PDF document text
- https://ictlife.vn/upload/files/2022/07/HxJMtquEKvaItDkCmFzc_05_c73db3cef1415170211b5fb97ba6aIn PDF document text
- http://staffdirect.info/wp-In PDF document text
- https://geto.space/upload/files/2022/07/7ha4xzlMjaD7YYCKYfXR_05_94b78d48ae2ae8bffbb8f1d33d6In PDF document text
- https://affiliateschools.com/upload/files/2022/07/KhyZPYZH85orWj2VLKBp_05_c73db3cef1415170211In PDF document text
- https://www.bsc.es/system/files/webform/cv_employment/mygegen638.pdfIn PDF document text
- https://brd.gov.md/sites/default/files/webform/attachments/vannail481.pdfIn PDF document text
- http://www.tcpdf.orgIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://www.aiim.org/pdfa/ns/extension/In PDF document text
- http://www.aiim.org/pdfa/ns/schema#In PDF document text
- http://www.aiim.org/pdfa/ns/property#In PDF document text
- http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign:
secureserver.net
1471 samples
Open this report in the interactive analyzer, or submit your own file for analysis.