Malicious PDF — malware analysis report

Heuristics 6

• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://mydrugdir.com/RHVyZ2EgU2FwdGFzaGF0aSBCZWVqIE1hbnRyYSBTYWRoYW5hIFBkZiAzNQRHV/adventitious/blurb.freestones/doubtful.mccrady/moisturiser/ZG93bmxvYWR8Y3Q3YUhSeGZId3hOall5Tmpnd016a3dmSHd5TlRrd2ZId29UU2tnVjI5eVpIQnlaWE56SUZ0WVRVeFNVRU1nVmpJZ1VFUkdYUQ.cymbalta PDF link annotation

  • https://l1.intimlobnja.ru/full-telestream-wirecast-pro-7-1-0-x64-incl-crack-link/In PDF document text
  • https://gembeltraveller.com/terminator-genisys-english-3-full-movie-in-english-free-download-__link__/In PDF document text
  • https://www.bg-frohheim.ch/bruederhofweg/advert/gta-vice-city-shqip-hack-offline-top/In PDF document text
  • http://www.drbonesonline.com/?p=36010In PDF document text
  • https://www.mtcpreps.com/wp-content/uploads/2022/09/Thandor_Die_Invasion_Windows_7_15.pdfIn PDF document text
  • http://streetbazaaronline.com/?p=102195In PDF document text
  • http://bitcointrading.se/?p=14652In PDF document text
  • https://www.vakantiehuiswinkel.nl/batchphoto-pro-4-4-full-crack-free/In PDF document text
  • https://bustedrudder.com/advert/hd-online-player-nvidia-purevideo-decoder-1-02-223-ke-high-quality/In PDF document text
  • https://hulpnaongeval.nl/wp-content/uploads/Descargar_Capitulos_De_Los_Imaginadores_En_Espanol_Latinol.pdfIn PDF document text
  • https://kmtu82.org/descargar-redcad-23-upd-full102-84/In PDF document text
  • https://hexol.com/wp-content/uploads/2022/09/INSTALL_Download_Igo8_Speedcamtxt_For_Europe.pdfIn PDF document text
  • http://www.bayislistings.com/toro-farcito-e-la-maledizione-della-piramide-download-new-gratis/In PDF document text
  • https://4hars.com/full-gta-vice-city-shqip-download-new/In PDF document text
  • http://yotop.ru/2022/09/09/commando-2-mp4-1080p-cracked-download-movies/In PDF document text
  • http://peninsular-host.com/autosmotos.es/advert/truecafe-4-6-crack-new-rar-bruce-japon-hello-ur/In PDF document text
  • https://kmtu82.org/native-instruments-komplete-9-ultimate-extra-quality-crack-torrent-2/In PDF document text
  • http://www.terrainsprives.com/wp-content/uploads/2022/09/rascar.pdfIn PDF document text
  • http://streetbazaaronline.com/?p=102197In PDF document text
  • https://juncty.com/wp-content/uploads/2022/09/carmvad.pdfIn PDF document text
  • https://l1.intimlobnja.ru/full-telestream-wirecast-pro-7-1-0-x64-incl-In PDF document text
  • https://gembeltraveller.com/terminator-genisys-english-3-full-movie-in-In PDF document text
  • https://www.bg-frohheim.ch/bruederhofweg/advert/gta-vice-city-shqip-In PDF document text
  • https://www.mtcpreps.com/wp-In PDF document text
  • https://bustedrudder.com/advert/hd-online-player-nvidia-purevideo-In PDF document text
  • https://hulpnaongeval.nl/wp-content/uploads/Descargar_Capitulos_De_In PDF document text
  • https://hexol.com/wp-content/uploads/2022/09/INSTALL_Download_IgoIn PDF document text
  • http://www.bayislistings.com/toro-farcito-e-la-maledizione-della-In PDF document text
  • http://yotop.ru/2022/09/09/commando-2-mp4-1080p-cracked-In PDF document text
  • http://peninsular-host.com/autosmotos.es/advert/truecafe-4-6-crack-In PDF document text
  • https://kmtu82.org/native-instruments-komplete-9-ultimate-extra-In PDF document text
  • http://mydrugdir.com/rhvyz2egu2fwdgfzagf0asbczwvqie1hbnryysbtywroyw5hifbkziaznqrhv/adventitious/blurb.freestones/doubtful.mccrady/moisturiser/zg93bmxvywr8y3q3yuhsegzid3hoall5tmpnd016a3dmshd5tlrrd2zid29uu2tnvji5evpiqnlawe56suz0wvrvefnvru1nvmpjz1vfukdyuq.cymbaltaIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.