Malicious PDF — malware analysis report

Heuristics 7

• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• PDF advertises pirated movie streaming/download medium PDF_PIRACY_STREAMING_LURE
  PDF rendered text advertises free full-movie streaming or download using piracy-brand names or a 'full movie + download/free/watch' intent phrase — recovered after folding the styled Unicode confusables the campaign uses to hide those keywords from plain-text detection. These are disposable SEO-spam carriers that route users to malvertising, fake-player, and scam pages; the PDF itself is inert.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://emailgoal.com/bicyclists/WGJveCAzNjAgRW11bGF0b3IgQmlvcyBWMy4yLjQucmFyIEZyZWUgRG93bmxvYWQWGJ/ZG93bmxvYWR8cjRkWjNCbllYeDhNVFkxTmpjM01UZ3hPSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/ilam...indiginious.guides PDF link annotation

  • https://autodjelovicg.com/advert/maxsurf-13-all-module-patch/In PDF document text
  • https://www.cameraitacina.com/en/system/files/webform/feedback/garrzol282.pdfIn PDF document text
  • https://corporateegg.com/half-life-2-no-steam-startup-crash-fix-repack/In PDF document text
  • https://witfoodx.com/adobe-premiere-pro-cc-2014-8-0-0-169-preactivated-repack-by-d-64-bit-top/In PDF document text
  • https://techessay.org/autocad-2013-portable-ingles/In PDF document text
  • https://instafede.com/camtasia-studio-8-software-keygen-maker-_verified_/In PDF document text
  • https://hhinst.com/advert/obtener-cuenta-vip-bibliocad-gratis/In PDF document text
  • http://www.divinejoyyoga.com/2022/07/03/eset-nod-32-smart-security-3-0-645-0-full-repack-key-67-years-registration-rar/In PDF document text
  • https://guarded-peak-92479.herokuapp.com/empire_total_war_patch_16_download.pdfIn PDF document text
  • https://yokohamaiaohio.com/sites/default/files/webform/dalljah72.pdfIn PDF document text
  • https://continentpost.com/wp-content/uploads/2022/07/Winsome_File_Renamer_80_Crack_LINK_Cocaine.pdfIn PDF document text
  • https://mandarinrecruitment.com/system/files/webform/downloads-drivers-surecom-ep325.pdfIn PDF document text
  • https://wanoengineeringsystems.com/hantu-kak-limah-balik-rumah-_top_-download-full-movie/In PDF document text
  • https://ebimarketing.com/wp-content/uploads/2022/07/ellaald.pdfIn PDF document text
  • https://mitiflowers.com/renault-true-code-v121-program-hot/In PDF document text
  • http://www.sansagenceimmo.fr/wp-content/uploads/2022/07/AUTODATA_889_Crack_FULL_2018_64_Bit_NEW.pdfIn PDF document text
  • https://43gear.com/optoelectronics-and-photonics-kasap-solution-manual-rar/In PDF document text
  • http://infoimmosn.com/?p=14390In PDF document text
  • http://emailgoal.com/bicyclists/wgjvecaznjagrw11bgf0b3igqmlvcybwmy4yljqucmfyiezyzwugrg93bmxvywqwgj/zg93bmxvywr8cjrkwjncbllyedhnvfkxtmpjm01uz3hpshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda/ilam...indiginious.guidesIn PDF document text
  • http://www.sansagenceimmo.fr/wp-content/uploads/2022/07/autodata_889_crack_full_2018_64_bit_new.pdfIn PDF document text
  • https://calsubsvertia1984.wixsite.com/travesinse/post/windows-7-ab-april-2019-wird-ein-sha-2-update-benotigtIn PDF document text
  • https://lasonyahartlage058.wixsite.com/oboutilrue/post/mirc-pezzottoIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.