Malicious PDF — malware analysis report

Heuristics 5

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• PDF links to a cracked-software download doorway (base64-obfuscated) high PDF_CRACKED_SOFTWARE_DOWNLOAD_DOORWAY
  PDF's embedded link hides a pirated-software title as a base64 blob inside the URL path/query (and/or carries the ``download|`` doorway-template marker), rather than in visible text. This is a TCPDF-generated SEO doorway that ranks for software-piracy searches and funnels users to fake 'crack/keygen' download pages distributing adware, potentially-unwanted programs, or droppers. The base64 encoding is deliberate obfuscation to evade plaintext lure rules; the PDF itself carries no parser exploit — the risk is the linked crack-download destination.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://dawnloadonline.com/ZG93bmxvYWR8Tks4TVhKNU5YeDhNVFkxTnpBek5qSXlNM3g4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/anonym/RmlmYSAyMgRml/bhiwani/brad=arrogant=clapp=indefectible=gendusa PDF link annotation

  • https://trabal.mx/2022/07/fifa-22-full-license-download/In PDF document text
  • http://www.giuseppes.com.au/system/files/webform/Fifa-22_0.pdfIn PDF document text
  • https://mandarinrecruitment.com/system/files/webform/maurlas34.pdfIn PDF document text
  • https://socialagora.xyz/upload/files/2022/07/mCsuRq9cxPTUJX8LbJVh_05_9a884c0817d98654b756bfa8c4e481fc_file.pdfIn PDF document text
  • https://sajjadkhodadadi.com/wp-content/uploads/2022/07/jarazand.pdfIn PDF document text
  • https://workschool.ru/upload/files/2022/07/neGzOJu1dvYNyX2OgIDi_05_a62a7da50adc8f96d3daf3695457bb6c_file.pdfIn PDF document text
  • https://ceza.gov.ph/system/files/webform/resume/darleon554.pdfIn PDF document text
  • https://pra-namorar.paineldemonstrativo.com.br/upload/files/2022/07/vboKIsiWtpumvPwLJvCw_05_9a884c0817d98654b756bfa8c4e481fc_file.pdfIn PDF document text
  • http://teignvalleypedalbashers.co.uk/advert/fifa-22-hacked-downloadIn PDF document text
  • https://www.bellinghamma.org/sites/g/files/vyhlif2796/f/uploads/ateresults05.03.22.pdfIn PDF document text
  • http://sourceofhealth.net/2022/07/05/fifa-22-activation-registration-code/In PDF document text
  • https://www.gayleatherbiker.de/upload/files/2022/07/GjoVtxndEWLsPHp5y3Xc_05_9a884c0817d98654b756bfa8c4e481fc_file.pdfIn PDF document text
  • http://aocuoieva.com/fifa-22-serial-key-for-pc/In PDF document text
  • https://africantoursguide.com/fifa-22-keygen-crack-setup-free-download/In PDF document text
  • https://paydayplus.net/system/files/webform/matiniss38.pdfIn PDF document text
  • https://sweetangels.in/wp-content/uploads/2022/07/caswelb.pdfIn PDF document text
  • https://ready2reading.com/wp-content/uploads/2022/07/Fifa_22-4.pdfIn PDF document text
  • https://www.realteqs.com/teqsplus/upload/files/2022/07/iQM1XikZEJlrdX5KqUlg_05_6fea186faa284a35f5225bbe2d566d8e_file.pdfIn PDF document text
  • https://hissme.com/upload/files/2022/07/nBJIg8DBte4Tj7HuqE1J_05_9a884c0817d98654b756bfa8c4e481fc_file.pdfIn PDF document text
  • https://65yee.com/wp-content/uploads/2022/07/Fifa_22_With_License_Key___Activation.pdfIn PDF document text
  • http://www.giuseppes.com.au/system/files/webform/Fifa-22In PDF document text
  • https://mandarinrecruitment.com/system/files/webform/maIn PDF document text
  • https://socialagora.xyz/upload/files/2022/07/mCsuRq9cxPTIn PDF document text
  • https://sajjadkhodadadi.com/wp-In PDF document text
  • https://workschool.ru/upload/files/2022/07/neGzOJu1dvYNyIn PDF document text
  • https://ceza.gov.ph/system/files/webform/resume/darleon5In PDF document text
  • https://pra-namorar.paineldemonstrativo.com.br/upload/fileIn PDF document text
  • http://teignvalleypedalbashers.co.uk/advert/fifa-22-hacked-In PDF document text
  • https://www.bellinghamma.org/sites/g/files/vyhlif2796/f/uplIn PDF document text
  • http://sourceofhealth.net/2022/07/05/fifa-22-activation-In PDF document text
  • https://www.gayleatherbiker.de/upload/files/2022/07/GjoVtIn PDF document text
  • https://africantoursguide.com/fifa-22-keygen-crack-setup-In PDF document text
  • https://paydayplus.net/system/files/webform/matiniss38.pdIn PDF document text
  • https://sweetangels.in/wp-In PDF document text
  • https://ready2reading.com/wp-In PDF document text
  • https://www.realteqs.com/teqsplus/upload/files/2022/07/iQIn PDF document text
  • https://hissme.com/upload/files/2022/07/nBJIg8DBte4Tj7HuIn PDF document text
  • https://65yee.com/wp-content/uploads/2022/07/Fifa_22_WitIn PDF document text
  • http://dawnloadonline.com/zg93bmxvywr8tks4tvhknu5yedhnvfkxtnpbek5qsxlnm3g4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda/anonym/rmlmysaymgrml/bhiwani/brad=arrogant=clapp=indefectible=gendusaIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.