Malicious PDF — malware analysis report

Heuristics 7

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://widesearchengine.com/VlJheSAzLjcgZm9yIFJldml0IDIwMTkgQ3JhY2sgTGF0ZXN0IFZlcnNpb24gRnJlZSBEb3dubG9hZAVlJ/argentinean/begaining.fuser.felts.ZG93bmxvYWR8V3E3T1Raa2NIeDhNVFkxTmpjM01UZ3hPSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA.jiffy./ PDF link annotation

  • http://barrillos.org/2022/07/02/malwarebytes-anti-malware-pro-1-75-0-1300-arma-setup-free-patched/In PDF document text
  • https://www.citylist.pk/wp-content/uploads/2022/07/Microsoft_24ghz_Transceiver_V70_Driver_Download.pdfIn PDF document text
  • http://www.giffa.ru/businesscareers/ffh4x-free-fire-mod-menu-v1-0-apk-download-latest-portable/In PDF document text
  • http://ideaboz.com/?p=34361In PDF document text
  • https://eyeglobe.org/wp-content/uploads/2022/07/P3D_V4_BlackMarbleNextGen_Base_Vector_Bridges_Stargazer_RIP_DRM_BETTER_Free.pdfIn PDF document text
  • https://4g89.com/wp-content/uploads/2022/07/Website_Ripper_Copier_392_Installer_Serial_Key_CRACKED.pdfIn PDF document text
  • https://www.rentbd.net/titan-quest-immortal-throne-crack-repack-1-17l/In PDF document text
  • http://www.sweethomeslondon.com/?p=In PDF document text
  • https://practicalislam.online/wp-content/uploads/2022/07/berhali.pdfIn PDF document text
  • https://goldplant.ro/wp-content/uploads/2022/07/Como_Borrar_Registro_De_Internet_Download_Manager_HOT.pdfIn PDF document text
  • http://maili.demoe.cn:112/upload/files/2022/07/HsN6FeLqsmEZcVlWsBkR_02_8463b5de1172ade0af2db71ceb4b5189_file.pdfIn PDF document text
  • https://www.verenigingvalouwe.nl/advert/chess-king-4-deep-pro-with-houdini-4-pro-inc-keygenchess-king-4-deep-pro-with-houdini-4-pro-inc-32-upd/In PDF document text
  • https://myblogtime.com/wp-content/uploads/2022/07/Xforce_Keygen_64bit_DWF_Writer_2007_Crack.pdfIn PDF document text
  • https://www.dominionphone.com/circuitos-electricos-edminister-tercera-edicion-pdf-33-extra-quality/In PDF document text
  • http://meowmeowcraft.com/2022/07/03/chameleon-bootloader-windows-free-exclusive-download/In PDF document text
  • https://aerosmith50years.com/wp-content/uploads/2022/07/rongab.pdfIn PDF document text
  • https://energy-varna.bg/sites/default/files/webform/giribapu-shiv-bhajan-mp3-51.pdfIn PDF document text
  • https://undergroundfrequency.com/upload/files/2022/07/jyAYpct4MUEQrit51Y2x_02_8463b5de1172ade0af2db71ceb4b5189_file.pdfIn PDF document text
  • https://centraldomarketing.com/mirc-7-56-crack-patched/In PDF document text
  • http://widesearchengine.com/vljhesazljcgzm9yifjldml0idiwmtkgq3jhy2sgtgf0zxn0ifzlcnnpb24grnjlzsbeb3dubg9hzavlj/argentinean/begaining.fuser.felts.zg93bmxvywr8v3e3t1raa2niedhnvfkxtmpjm01uz3hpshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda.jiffy./In PDF document text
  • https://4g89.com/wp-content/uploads/2022/07/website_ripper_copier_392_installer_serial_key_cracked.pdfIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.