Malicious PDF — malware analysis report

Heuristics 6

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
  PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://xtraserp.com/R2FtYmFyIGNld2VrIGluZG8gYnVnaWwucmFyR2F/jaycees.jesian/sarong?microphotographic=/coldwell/reciprocal/ZG93bmxvYWR8U3c1TVRkbE5HWjhmREUyTmpJMk9EQXpPVEI4ZkRJMU9UQjhmQ2hOS1NCWGIzSmtjSEpsYzNNZ1cxaE5URkpRUXlCV01pQlFSRVpk PDF link annotation

  • https://teenmemorywall.com/dynex-dx-dtcam-web-camera-driver-64-bit-link/In PDF document text
  • https://buycoffeemugs.com/film-documentario-bob-marley-2012-download-torrent-ita-link/In PDF document text
  • https://susanpalmerwood.com/photoinstrument-61-registration-key-free-download-free/In PDF document text
  • https://efekt-metal.pl/witaj-swiecie/In PDF document text
  • https://geoacademicjournals.com/wp-content/uploads/2022/09/ArcaniaGothic4RELOADEDcrackonlyfitgirlrepack_EXCLUSIVE.pdfIn PDF document text
  • https://grxgloves.com/rayman-origins-pc-download-full-version-verified/In PDF document text
  • http://www.filmwritten.org/wp-content/uploads/2022/09/Havij_Full_Download.pdfIn PDF document text
  • https://nearbyhostels.com/wp-content/uploads/2022/09/Electronic_Devices_And_Circuits_By_Bogart_Pdf_Free_Download_Extra_Quality.pdfIn PDF document text
  • https://inmobiliaria-soluciones-juridicas.com/2022/09/image-pro-plus-6-0-crack-hotIn PDF document text
  • https://assetdefenseteam.com/wp-content/uploads/2022/09/Haruna_Kawaguchi_Harunazip.pdfIn PDF document text
  • https://pi-brands.com/wp-content/uploads/2022/09/deldesh.pdfIn PDF document text
  • http://moonreaderman.com/instashare-for-windows-crack-keyinstmankl-upd/In PDF document text
  • http://mrproject.com.pl/advert/historietas-de-hentai-follando-ami-tia-culona-poringa/In PDF document text
  • https://connectingner.com/2022/09/12/new-york-nagaram-songs-hd-1080p-blu-ray-44-link/In PDF document text
  • http://insenergias.org/?p=81905In PDF document text
  • https://bhatimindcare.com/wp-content/uploads/2022/09/wiledal.pdfIn PDF document text
  • https://nucleodenegocios.com/guru-nanak-aarti-pdf-11-install/In PDF document text
  • https://tempusgems.com/wp-content/uploads/2022/09/Download_Hackboot_1.pdfIn PDF document text
  • http://coopdespensasolidaria.com/?p=37157In PDF document text
  • https://earthoceanandairtravel.com/2022/09/12/sapphirefoxx-different-perspectives-372-400-completed-gender-bender-adult-comics-almerias-new/In PDF document text
  • https://geoacademicjournals.com/wp-In PDF document text
  • https://nearbyhostels.com/wp-content/uploads/2022/09/Electronic_Devices_And_Circuits_BIn PDF document text
  • https://assetdefenseteam.com/wp-In PDF document text
  • https://earthoceanandairtravel.com/2022/09/12/sapphirefoxx-different-In PDF document text
  • http://xtraserp.com/r2ftymfyignld2vrigluzg8gynvnawwucmfyr2f/jaycees.jesian/sarong?microphotographic=/coldwell/reciprocal/zg93bmxvywr8u3c1tvrkbe5hwjhmreuytmpjmk9eqxppvei4zkrjmu9uqjhmq2hos1ncwgizsmtjsepsyznnz1cxae5urkpruxlcv01pqlfsrvpkIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.