Malicious PDF — malware analysis report

Heuristics 7

• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Viral-video clickbait PDF links to suspicious host critical SE_VIRAL_VIDEO_CLICKBAIT_LINK
  Document uses viral/leaked-video lure text and links to a suspicious disposable-looking web host. This is a clickbait/traffic-scam carrier shape rather than a benign PDF link.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://xtraserp.com/authorizing/ZG93bmxvYWR8WFMwWm5KdWFueDhNVFkxTmpjM01UZ3hPSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/c3BlZWRydW5uZXJzbXVsdGlwbGF5ZXJjcmFjazMwc3B?bossy&effectual=elaborates&choledocholithiasis=emotion PDF link annotation

  • https://aboutdance.com.ua/advert/planet-terror-full-movie-in-hindi-dubbed-download-better/In PDF document text
  • http://www.italiankart.it/advert/super-machi-video-song-hd-1080p-link/In PDF document text
  • https://community.soulmateng.net/upload/files/2022/07/kDwccoxu79XG674HqdBu_03_b93f7076fe68cf7ef662209cbbd12259_file.pdfIn PDF document text
  • https://petstable.mx/3000-dias-no-bunker-pdf-download-hot/In PDF document text
  • https://www.thelearningcirclekirtland.com/wp-content/uploads/2022/07/Bulbulay_All_Episodes_Free_Download_3gp_Format_LINK-1.pdfIn PDF document text
  • https://www.town.duxbury.ma.us/sites/g/files/vyhlif3056/f/uploads/resident_beach_sticker_application_2020_rev_5.27.20.pdfIn PDF document text
  • https://thawing-beyond-98281.herokuapp.com/quander.pdfIn PDF document text
  • http://trabajarenlafrater.com/wp-content/uploads/2022/07/3d_Pageflip_Professional_176_Keygen_58.pdfIn PDF document text
  • https://murmuring-scrubland-33006.herokuapp.com/PATCHED_Wondershare_Filmora_8740_Crack_CracksMind.pdfIn PDF document text
  • https://thebrothers.cl/all-india-reporter-cases-cd-free-download-top/In PDF document text
  • http://outdooryogany.com/wp-content/uploads/2022/07/DOWNLOAD_FIFA_2007_FULL_WINDOWS_7_64_BIT.pdfIn PDF document text
  • https://shrouded-oasis-20812.herokuapp.com/aleival.pdfIn PDF document text
  • http://dokterapk.com/?p=11257In PDF document text
  • https://cambodiaonlinemarket.com/wp-content/uploads/2022/07/ivaniti.pdfIn PDF document text
  • https://cdn.scholarwithin.com/media/20220702183621/Garmin_Bluechart_G2_Vision_VEU704L__France_Crack_LINK.pdfIn PDF document text
  • http://match2flame.com/return-to-castle-wolfenstein-2-0-0-2-gog-tournament-cheats/In PDF document text
  • https://socialagora.xyz/upload/files/2022/07/Rxd5UquqnM6FRyyO82Ua_03_fe55ec0204bed1f3681f5968cb264844_file.pdfIn PDF document text
  • https://hoponboardblog.com/2022/07/korg-pa-user-bank-manager-download-work-crack/In PDF document text
  • https://elsm.ch/advert/learn-to-listen-listen-to-learn-1-answer-key-rar-work/In PDF document text
  • https://guc.lt/index.php/lt/photoinstrument-7-6-build-922-keygen-new-cracksnow-download-pc/In PDF document text
  • http://xtraserp.com/authorizing/zg93bmxvywr8wfmwwm5kdwfuedhnvfkxtmpjm01uz3hpshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda/c3blzwrydw5uzxjzbxvsdglwbgf5zxjjcmfjazmwc3b?bossy&effectual=elaborates&choledocholithiasis=emotionIn PDF document text
  • http://trabajarenlafrater.com/wp-content/uploads/2022/07/3d_pageflip_professional_176_keygen_58.pdfIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.