Malicious PDF — malware analysis report

Heuristics 8

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
  PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://dormister.com/availabe/beechnut/gentex/bulger.ZG93bmxvYWR8QlU4YTNreWZId3hOamN4TlRRMk5EQTNmSHd5TmpJMWZId29UU2tnVjI5eVpIQnlaWE56SUZ0UVJFWmQ?RGlhYmxvIDIgVW5hYmxlIFRvIExvYWQgTXVsdGlyZXMuZGxsRGl=/mediaplayer/pattaya/blase PDF link annotation

  • https://player.soundon.fm/p/HD-Online-Player-The-Hidden-Face-1080p-Torren-cenbIn PDF document text
  • https://player.soundon.fm/p/Download-Dt07img-Pes-2013-UPD-anenabtbizitIn PDF document text
  • https://player.soundon.fm/p/Write-Better-Speak-Better-Readers-Digest-Pdf-patkaIn PDF document text
  • https://player.soundon.fm/p/Ultra-Audio-Recorder-V744278-Serial-trinadhaterctaIn PDF document text
  • https://player.soundon.fm/p/Hptuners-Vcm-Suite-Serial-Keygen-Free-asudovphoteIn PDF document text
  • https://player.soundon.fm/p/Jascpaintshoppro9trialserial21-HOT-coatavisubtteIn PDF document text
  • https://player.soundon.fm/p/Garrys-Mod-Additional-Content-Pack-Full-CPY-B-smarIn PDF document text
  • https://player.soundon.fm/p/The-Sopranos-Complete-Series-Blu-Ray-Torrent-terriIn PDF document text
  • https://shopigan.com/lungidancehindimoviemp3songupd-freedownload/In PDF document text
  • https://instafede.com/wp-content/uploads/2022/12/Donkey_Kong_64_Wad.pdfIn PDF document text
  • https://www.webcard.irish/angry-indian-goddesses-4-full-portable-movie-in-hindi-hd-1080p-download/In PDF document text
  • https://ingamoga.ro/corel-draw-x4-verified-keygen-by-kaizer-soze-core/In PDF document text
  • https://jgbrospaint.com/2022/12/20/wilcom-embroidery-studio-e2-dongle-crack-download-__hot__/In PDF document text
  • https://vitraya.io/wp-content/uploads/2022/12/Perfildeumamentecriminosadownloadpdf-VERIFIED.pdfIn PDF document text
  • https://asocluzdeloeste.org/wp-content/uploads/2022/12/Download-Dil-Ka-Rishta-2-NEW-Full-Movie-Subtitle-Indonesia-Download.pdfIn PDF document text
  • https://worldmediatravel.com/wp-content/uploads/2022/12/13b_full_movie_download_720p_movies.pdfIn PDF document text
  • http://mitnurulamalparang.com/scienzadeimaterialipdfverified-download/In PDF document text
  • https://us4less-inc.com/wp-content/uploads/wandsafa.pdfIn PDF document text
  • https://xn--80aagyardii6h.xn--p1ai/dil-maange-more-marathi-movie-better-download-hd-9995-127999/In PDF document text
  • https://arlingtonliquorpackagestore.com/nvidias-361-43-whql-driver-for-windows-10-__full__/In PDF document text
  • https://obedientk-9.com/wp-content/uploads/2022/12/loumar.pdfIn PDF document text
  • https://supportingyourlocal.com/wp-content/uploads/2022/12/Gt90x-A20-103-LINK.pdfIn PDF document text
  • https://teenmemorywall.com/wp-content/uploads/2022/12/Geometria_1_Sernesi_Bollati_Boringhieri_Pdf_35.pdfIn PDF document text
  • https://mentorus.pl/the-black-and-white-album-the-hives-zip-free/In PDF document text
  • https://1w74.com/wp-content/uploads/2022/12/UPD_Free_Hairy_Pussy_Fuck_Videos.pdfIn PDF document text
  • https://pianoetrade.com/wp-content/uploads/2022/12/danieli.pdfIn PDF document text
  • http://quitoscana.it/2022/12/20/betting-assistant-wmc-1-2-crack-fix/In PDF document text
  • http://apartmentsforcheap.org/?p=1075In PDF document text
  • https://www.webcard.irish/angry-indian-goddesses-4-full-portable-movie-in-hindi-hd-1080p-downloadIn PDF document text
  • https://vitraya.io/wp-content/uploads/2022/12/Perfildeumamentecriminosadownloadpdf-VERIFIED.pdIn PDF document text
  • https://asocluzdeloeste.org/wp-content/uploads/2022/12/Download-Dil-Ka-Rishta-2-NEW-Full-Movie-In PDF document text
  • https://worldmediatravel.com/wp-content/uploads/2022/12/13b_full_movie_download_720p_movies.pIn PDF document text
  • https://teenmemorywall.com/wp-content/uploads/2022/12/Geometria_1_Sernesi_Bollati_Boringhieri_In PDF document text
  • http://dormister.com/availabe/beechnut/gentex/bulger.zg93bmxvywr8qlu4ytnrewzid3hoamn4tlrrmk5eqtnmshd5tmpjmwzid29uu2tnvji5evpiqnlawe56suz0uvjfwmq?rglhymxvidigvw5hymxlifrviexvywqgtxvsdglyzxmuzgxsrgl=/mediaplayer/pattaya/blaseIn PDF document text
  • http://dejavu.sourceforge.netFontsIn extracted file (font_02_sfnt_off0000b154.bin)
  • http://dejavu.sourceforge.netIn extracted file (stream_006_off00004876.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (stream_006_off00004876.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseDejaVuIn extracted file (font_02_sfnt_off0000b154.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.