Malicious PDF — malware analysis report

Heuristics 7

• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF links to a cracked-software download doorway (base64-obfuscated) high PDF_CRACKED_SOFTWARE_DOWNLOAD_DOORWAY
  PDF's embedded link hides a pirated-software title as a base64 blob inside the URL path/query (and/or carries the ``download|`` doorway-template marker), rather than in visible text. This is a TCPDF-generated SEO doorway that ranks for software-piracy searches and funnels users to fake 'crack/keygen' download pages distributing adware, potentially-unwanted programs, or droppers. The base64 encoding is deliberate obfuscation to evade plaintext lure rules; the PDF itself carries no parser exploit — the risk is the linked crack-download destination.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://bestentrypoint.com/dataprotection/ZG93bmxvYWR8V2gzWjJwM2NYeDhNVFkyTWpZNE1ETTVNSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA.mchagans?mughal=/SXBob25lIDQgZml4IHVubG9jayB0b29sIDIuNCAySXB/mils.saturate&jardiniere=savoy PDF link annotation

  • https://globaltechla.com/panduan-pengembangan-bahan-ajar-depdiknas-2008-pdf/In PDF document text
  • https://boardingmed.com/2022/09/10/game-server-control-panel-nulled-xenforo-repack/In PDF document text
  • https://witfoodx.com/free-xforce-keygen-32bits-or-64bits-version-fusion-lifecycle-2018-key/In PDF document text
  • https://expressionpersonelle.com/comsol-4-0a-license-file-updated/In PDF document text
  • https://www.zper.it/wp-content/uploads/2022/09/Staind_Discography_19962012.pdfIn PDF document text
  • https://instantitschool.com/xforce-keygen-64-bit-3ds-max-2019-free-verified-download/In PDF document text
  • https://www.bayer-moebel.de/index.php/2022/09/hd-online-player-bari-tar-bangla-bengali-movie-free-__top__-d/In PDF document text
  • http://www.studiofratini.com/visual-pinball-emulator-80-real-gamesvxd-version-download-top/In PDF document text
  • https://www.chiesacristiana.eu/2022/09/10/antares-avox-bundle-vst-rtas-v1-1-3-air-torrent-exclusive/In PDF document text
  • https://brutalrecords.com/wp-content/uploads/2022/09/Folder_Marker_Pro_30_Crack_FREE_15.pdfIn PDF document text
  • http://www.italiankart.it/advert/starry-night-download-windows-7-11-upd/In PDF document text
  • https://www.agrizoeker.nl/wp-content/uploads/2022/09/maurnea.pdfIn PDF document text
  • http://newsseva.in?p=35021In PDF document text
  • http://www.midax.it/registrazione-utenti/In PDF document text
  • https://www.fashionservicenetwork.com/wp-content/uploads/2022/09/City_Car_Driving_Free_Download_V227_Crackl.pdfIn PDF document text
  • https://momentsofjoys.com/2022/09/10/halflife2ultimateedition7pc-better/In PDF document text
  • http://fokusparlemen.id/?p=56029In PDF document text
  • http://subsidiosdelgobierno.site/?p=26284In PDF document text
  • https://rednails.store/adobe-acrobat-pro-dc-2018-025-20092-crack-__top__-129311/In PDF document text
  • https://www.vikaybeauty.com/wp-content/uploads/2022/09/Thattathin_Marayathu_Malayalam_Full_EXCLUSIVE_Movie_Watch_Online_Youku.pdfIn PDF document text
  • https://www.bayer-moebel.de/index.php/2022/09/hd-online-player-bari-tar-bangla-bengali-In PDF document text
  • http://www.studiofratini.com/visual-pinball-emulator-80-real-gamesvxd-version-download-In PDF document text
  • https://www.chiesacristiana.eu/2022/09/10/antares-avox-bundle-vst-rtas-v1-1-3-air-torrent-In PDF document text
  • https://brutalrecords.com/wp-In PDF document text
  • https://www.fashionservicenetwork.com/wp-In PDF document text
  • https://www.vikaybeauty.com/wp-content/uploads/2022/09/Thattathin_Marayathu_MalayalIn PDF document text
  • http://bestentrypoint.com/dataprotection/zg93bmxvywr8v2gzwjjwm2nyedhnvfkytwpzne1ettvnshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda.mchagans?mughal=/sxbob25lidqgzml4ihvubg9jayb0b29sidiuncaysxb/mils.saturate&jardiniere=savoyIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.