Malicious PDF — malware analysis report

Heuristics 5

• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF links to a cracked-software download doorway (base64-obfuscated) high PDF_CRACKED_SOFTWARE_DOWNLOAD_DOORWAY
  PDF's embedded link hides a pirated-software title as a base64 blob inside the URL path/query (and/or carries the ``download|`` doorway-template marker), rather than in visible text. This is a TCPDF-generated SEO doorway that ranks for software-piracy searches and funnels users to fake 'crack/keygen' download pages distributing adware, potentially-unwanted programs, or droppers. The base64 encoding is deliberate obfuscation to evade plaintext lure rules; the PDF itself carries no parser exploit — the risk is the linked crack-download destination.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://evacdir.com/UHlQbGF5UHl/treos.zalaznick/hamster.panchkula.ZG93bmxvYWR8RFQ3TW1aM2FIeDhNVFkxTlRJNU9UZzBOSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA?punakha=trent PDF link annotation

  • https://sheltered-garden-61617.herokuapp.com/makachr.pdfIn PDF document text
  • https://digitalmentors.pro/2022/06/15/snfacecrop-with-product-key-��������������-for-pc/In PDF document text
  • http://lectomania.com/wp-content/uploads/2022/06/TwoBind.pdfIn PDF document text
  • http://buymecoffee.co/?p=23023In PDF document text
  • https://houstonhousepc.com/novirusthanks-file-governor-portable-������������������-��������������-������������������/In PDF document text
  • http://findmallorca.com/boxedapp-packer-����������������������������-������������-������������-with-keygen-��/In PDF document text
  • https://gamedevnikhil.com/wp-content/uploads/2022/06/gabrkee.pdfIn PDF document text
  • http://www.antiquavox.it/asus-wl-330n-wireless-router-utilities-����������������������������-������������-������������/In PDF document text
  • https://aboutdance.com.ua/advert/enigma-softphone-aktivatsiya-skachat-besplatno-bez-registratsii-pc-windows/In PDF document text
  • http://www.vidriositalia.cl/?p=14702In PDF document text
  • http://www.landtitle.info/olsr-daemon-��������-full-product-key-��������������-������������������-������-��������/In PDF document text
  • http://awaazsachki.com/?p=33935In PDF document text
  • https://kvmichocolates.com/wp-content/uploads/APDF_Content_Splitter____3264bit.pdfIn PDF document text
  • http://www.intersections.space/wp-content/uploads/2022/06/wondershare_dvd_slideshow_builder_standard.pdfIn PDF document text
  • http://www.b3llaphotographyblog.com/zebra-screen-recorder-������������������-license-key-��������������-������������������-latest/In PDF document text
  • http://videospornocolombia.com/?p=51563In PDF document text
  • https://jgbrospaint.com/2022/06/15/lojack-for-laptops-standard-with-keygen-��������������-2022-new/In PDF document text
  • https://sugaringspb.ru/microsoft-exchange-server-best-practices-analyzer-tool-aktivatsiya-keygen-full-version-skachat-besplatno-bez-registratsii-mac-win-updated-2022/In PDF document text
  • https://sugaringspb.ru/microsoft-exchange-server-best-practices-analyzer-tool-aktivatsiya-keygen-full-version-skachat-besplatno-In PDF document text
  • http://findmallorca.com/boxedapp-packer-активированная-полная-версия-with-keygen-с/In PDF document text
  • http://evacdir.com/uhlqbgf5uhl/treos.zalaznick/hamster.panchkula.zg93bmxvywr8rfq3tw1am2fiedhnvfkxtlrjnu9uzzboshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda?punakha=trentIn PDF document text
  • https://taotingzykmo1976.wixsite.com/inanlestie/post/free-ipad-to-computer-transfer-��������-free-registration-code-��������������-32-64bitIn PDF document text
  • https://soundcollapse.altervista.org/advert/dice-histogram-serial-number-full-torrent-%d1%81%d0%ba%d0%b0%d1%87%d0%b0%d1%82%d1%8c/In PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • https://taotingzykmo1976.wixsite.com/inanlestie/post/free-ipad-to-computer-transfer-��������-free-registration-code-In PDF document text
  • https://soundcollapse.altervista.org/advert/dice-histogram-serial-number-full-In PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.