Malicious PDF — malware analysis report

Heuristics 6

• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://evacdir.com/dGVyamVtYWhhbnRhcmJpeWF0dWxhdWxhZHBkZmRvd25sb2FkdGV/ZG93bmxvYWR8dG01TldGMU9IeDhNVFkxTkRjNE1EZzNPWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/hops/allocation.disposition/?ccsso=dissertations& PDF link annotation

  • https://www.vallemare.info/wp-content/uploads/2022/06/linoka.pdfIn PDF document text
  • https://educationnews.co.ke/advert/tomb-raider-2013-no-cd-no-dvd-patch/In PDF document text
  • http://areaspettacoli.com/wp-content/uploads/pyppvio.pdfIn PDF document text
  • https://apolloinstitute.com.au/moodle/blog/index.php?entryid=1157In PDF document text
  • https://our-study.com/upload/files/2022/06/PsEz8K5qcQIVQMDIEIHJ_10_2d6236fb2d9a91fc6a02d5d0f87b609c_file.pdfIn PDF document text
  • https://comoemagrecerrapidoebem.com/?p=6984In PDF document text
  • https://longitude123.net/wp-content/uploads/2022/06/Skins__VDJ_Internal_Mixer_RMX_1024x768.pdfIn PDF document text
  • http://www.buriramguru.com/wp-content/uploads/2022/06/animal_crossing_lets_go_to_the_city_wii_pal_torrent.pdfIn PDF document text
  • https://liquidonetransfer.com.mx/?p=8437In PDF document text
  • https://buri.site/wp-content/uploads/2022/06/cubase_6_full_version_free_download_25.pdfIn PDF document text
  • https://dulcexv.com/wp-content/uploads/2022/06/Crouzet_Millenium_3_USB_Driver__406_click.pdfIn PDF document text
  • https://kaalama.org/upload/files/2022/06/KBc6oJYHaw4GFq6m8N7v_10_2d6236fb2d9a91fc6a02d5d0f87b609c_file.pdfIn PDF document text
  • https://happybirthday2me.com/wp-content/uploads/2022/06/vasmar.pdfIn PDF document text
  • https://www.siriusarchitects.com/advert/tartarini-program-crack/In PDF document text
  • http://www.neorestaurantqatar.com/wp-content/uploads/2022/06/AutoCAD_2013_Serial_Number.pdfIn PDF document text
  • http://cubaricosworld.com/wp-content/uploads/2022/06/Email_Verifier_Software_Crack_22l_Extra_Quality.pdfIn PDF document text
  • https://firmateated.com/wp-content/uploads/2022/06/EDIUS_6_Pro_For_Windows_Full_Version_2020.pdfIn PDF document text
  • https://chatbook.pk/upload/files/2022/06/wkGbKslx4yY5Q5zZRtwD_10_2d6236fb2d9a91fc6a02d5d0f87b609c_file.pdfIn PDF document text
  • http://www.emk-reutlingen.de/advert/playful-kiss-full-episodes-free-download-with-english-subtitles-best/In PDF document text
  • https://brandyallen.com/2022/06/10/adobe-acrobat-xi-pro-11-0-9-mult/In PDF document text
  • https://our-study.com/upload/files/2022/06/PsEz8K5qcQIVQMDIEIHJ_10_2d6236fb2d9a91fc6a02In PDF document text
  • https://longitude123.net/wp-In PDF document text
  • http://www.buriramguru.com/wp-In PDF document text
  • https://dulcexv.com/wp-In PDF document text
  • https://kaalama.org/upload/files/2022/06/KBc6oJYHaw4GFq6m8N7v_10_2d6236fb2d9a91fc6a02dIn PDF document text
  • http://www.neorestaurantqatar.com/wp-In PDF document text
  • http://cubaricosworld.com/wp-In PDF document text
  • https://firmateated.com/wp-In PDF document text
  • https://chatbook.pk/upload/files/2022/06/wkGbKslx4yY5Q5zZRtwD_10_2d6236fb2d9a91fc6a02d5In PDF document text
  • http://www.emk-reutlingen.de/advert/playful-kiss-full-episodes-free-download-with-english-subtitles-In PDF document text
  • http://evacdir.com/dgvyamvtywhhbnrhcmjpewf0dwxhdwxhzhbkzmrvd25sb2fkdgv/zg93bmxvywr8dg01tldgmu9iedhnvfkxtkrjne1ezznpwhg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda/hops/allocation.disposition/?ccsso=dissertations&In PDF document text
  • http://cubaricosworld.com/wp-content/uploads/2022/06/email_verifier_software_crack_22l_extra_quality.pdfIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.