Malicious PDF — malware analysis report

Heuristics 5

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
  PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://starsearchtool.com/dorsum.unguarded?esssential=ZG93bmxvYWR8OTQ2WkhFNWRIeDhNVFkxTnpBMk56RTFOSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA&SG93IFRvIEhhY2sgUGFzc3dvcmQgVXNpbmcgVVNCIFBhcnQuMiBDaHJvbWUgQW5kIE9wZXJhIFN1cHBvcnRlZCAhSG9=transfusions PDF link annotation

  • https://attitude.ferttil.com/upload/files/2022/07/kUhN3XQ1b8Ez7qe2AGD8_06_cb4f0fb0465b08c9e98eb2446ff7c33a_file.pdfIn PDF document text
  • https://mentorus.pl/wp-content/uploads/2022/07/Ntsd_27_Downloadrar_LINK.pdfIn PDF document text
  • https://techstoserve.com/wp-content/uploads/2022/07/bela_seshe_movie_download_720p_30-1.pdfIn PDF document text
  • https://exatasolucoes.net/wp-content/uploads/2022/07/win7activatornewrar.pdfIn PDF document text
  • https://scrolllinkupload.s3.amazonaws.com/upload/files/2022/07/PhMXH3WED9x4YcQ1Zx3i_06_b4e73f57a1cd809450b5ab64a2601633_file.pdfIn PDF document text
  • http://thingsforfitness.com/?p=29029In PDF document text
  • https://onlinenews.store/chandni-movies-dual-audio-720p-hd/��������/In PDF document text
  • https://www.bpomas.co.bw/system/files/webform/files/Adobe-Illustrator-CC-2018-V2102242-Incl-Crack-Download-Pc.pdfIn PDF document text
  • https://jariosos.com/upload/files/2022/07/jF6Frw4WxZRmjj1ABqhU_06_8acddd658f23db2fce856965346a75f4_file.pdfIn PDF document text
  • https://cristinalinassi.com/wp-content/uploads/Farmville_2_Download_REPACK_Free_Full_Version_For_Pc.pdfIn PDF document text
  • http://wolontariusz.com/advert/hd-online-player-tamil-dubbed-1080p-movies-naam-shaba/In PDF document text
  • https://www.paramedicinecouncil.nsw.gov.au/system/files/webform/councildirectedhealthassessmentsrefereereports/betsyal241.pdfIn PDF document text
  • http://in-loving-memory.online/?p=33461In PDF document text
  • https://www.fiol-mallorca.com/upload/files/2022/07/Ha5m6furWUvNpDYRLULX_06_cb4f0fb0465b08c9e98eb2446ff7c33a_file.pdfIn PDF document text
  • https://www.petersonsign.com/sites/default/files/webform/publicfiles/amilosma561.pdfIn PDF document text
  • https://fotofables.com/cbt-nuggets-login-username-password/In PDF document text
  • https://www.coneyislandhistory.org/sites/default/files/webform/nefetry862.pdfIn PDF document text
  • https://kurditi.com/upload/files/2022/07/TBPKAcNC41SUxmDGjbpF_06_8acddd658f23db2fce856965346a75f4_file.pdfIn PDF document text
  • https://www.plori-sifnos.gr/making-a-refractor-telescope-norman-remer-pdf-12/In PDF document text
  • https://attitude.ferttil.com/upload/files/2022/07/kUhN3XQ1b8Ez7qe2AGD8_06_cb4f0fb0465b08c9eIn PDF document text
  • https://scrolllinkupload.s3.amazonaws.com/upload/files/2022/07/PhMXH3WED9x4YcQ1Zx3i_06_b4eIn PDF document text
  • https://onlinenews.store/chandni-movies-dual-audio-720p-hd/��������������/In PDF document text
  • https://www.bpomas.co.bw/system/files/webform/files/Adobe-Illustrator-CC-2018-V2102242-Incl-In PDF document text
  • https://jariosos.com/upload/files/2022/07/jF6Frw4WxZRmjj1ABqhU_06_8acddd658f23db2fce856965In PDF document text
  • https://cristinalinassi.com/wp-In PDF document text
  • https://www.paramedicinecouncil.nsw.gov.au/system/files/webform/councildirectedhealthassessmeIn PDF document text
  • https://www.fiol-mallorca.com/upload/files/2022/07/Ha5m6furWUvNpDYRLULX_06_cb4f0fb0465b08In PDF document text
  • https://kurditi.com/upload/files/2022/07/TBPKAcNC41SUxmDGjbpF_06_8acddd658f23db2fce856965In PDF document text
  • http://starsearchtool.com/dorsum.unguarded?esssential=zg93bmxvywr8otq2wkhfnwriedhnvfkxtnpbmk56rtfoshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda&sg93ifrviehhy2sgugfzc3dvcmqgvxnpbmcgvvncifbhcnqumibdahjvbwugqw5kie9wzxjhifn1chbvcnrlzcahsg9=transfusionsIn PDF document text
  • http://www.texasattorneygeneral.gov/sites/default/files/files/divisions/open-government/openmeetings_hb.pdfIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.texasattorneygeneral.gov/sites/default/files/files/divisions/open-In PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.