Malicious PDF — malware analysis report

Heuristics 5

• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF links to a cracked-software download doorway (base64-obfuscated) high PDF_CRACKED_SOFTWARE_DOWNLOAD_DOORWAY
  PDF's embedded link hides a pirated-software title as a base64 blob inside the URL path/query (and/or carries the ``download|`` doorway-template marker), rather than in visible text. This is a TCPDF-generated SEO doorway that ranks for software-piracy searches and funnels users to fake 'crack/keygen' download pages distributing adware, potentially-unwanted programs, or droppers. The base64 encoding is deliberate obfuscation to evade plaintext lure rules; the PDF itself carries no parser exploit — the risk is the linked crack-download destination.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://evacdir.com/ZG93bmxvYWR8TlYyTkRWd2MzeDhNVFkxTkRjek1EZzRObng4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA&forearmed/kshitija&moral/d2luZG93cyA3IExvYWRlciBleHRyZW1lIGVkaXRpb24gdjMgNCAyMDExIDEyIHBsdXMgYWN0aXZhdG9yd2l/crushproof.glorify PDF link annotation

  • https://eqlidi.ir/wp-content/uploads/2022/06/heavuzo.pdfIn PDF document text
  • https://heidylu.com/wp-content/uploads/2022/06/dussale.pdfIn PDF document text
  • https://zip-favor.ru/wp-content/uploads/2022/06/fetch_ftp_serial_number_mac.pdfIn PDF document text
  • https://www.plori-sifnos.gr/soul-movie-in-hindi-mp4-download/In PDF document text
  • https://www.jdbn.fr/wp-content/uploads/2022/06/zameer_new_full_length_bollywood_hindi_movie_ajay_devgan.pdfIn PDF document text
  • https://yourtripboy.com/wp-content/uploads/2022/06/pemrograman_c_budi_raharjo_pdf_14.pdfIn PDF document text
  • https://articlewatt.com/wp-content/uploads/2022/06/aleama.pdfIn PDF document text
  • https://matzenab.se/wp-content/uploads/2022/06/makakell.pdfIn PDF document text
  • https://socialcaddiedev.com/wp-content/uploads/2022/06/antdar.pdfIn PDF document text
  • https://plussizedesi.com/wp-content/uploads/2022/06/tadlkeig.pdfIn PDF document text
  • https://www.lion.tech/wp-content/uploads/2022/06/Night_Tamil_Dubbed_Torrent.pdfIn PDF document text
  • https://daniellechildrensfund.org.ec/red_convivencia_ec/blog/index.php?entryid=345In PDF document text
  • https://baybenmx.com/wp-content/uploads/2022/06/Maya_2018_Activation_Code_Keygen_Free_Download.pdfIn PDF document text
  • https://www.madrassah.mu/blog/index.php?entryid=676In PDF document text
  • https://millicanreserve.com/wp-content/uploads/2022/06/gilldeni.pdfIn PDF document text
  • https://csermoocf6ext.blog/wp-content/uploads/2022/06/hellalei.pdfIn PDF document text
  • https://media.langsong.site/wp-content/uploads/2022/06/download_wilcom_2006_portable_53.pdfIn PDF document text
  • https://media1.ambisonic.se/2022/06/Viva_Pinata_Product_Key_REPACK_Keygen.pdfIn PDF document text
  • https://geto.space/upload/files/2022/06/lPDnNRGBAoxlTqQasXQd_09_55a232860ff3a2b7b5a66fe06bc3734e_file.pdfIn PDF document text
  • https://baybenmx.com/wp-content/uploads/2022/06/maya_2018_activation_code_keygen_free_download.pdfIn PDF document text
  • http://evacdir.com/zg93bmxvywr8tlyytkrwd2mzedhnvfkxtkrjek1ezzrobng4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda&forearmed/kshitija&moral/d2luzg93cya3iexvywrlciblehryzw1ligvkaxrpb24gdjmgncaymdexideyihbsdxmgywn0axzhdg9yd2l/crushproof.glorifyIn PDF document text
  • https://enlidirthighmo.wixsite.com/udavkepin/post/nuance-power-pdf-advanced-1-0-x86-x64-incl-keymaker-coreIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.