Malicious PDF — malware analysis report

Heuristics 7

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://dormister.com/agreeing/ZG93bmxvYWR8dzlwTm05Mk0zeDhNVFkyTWpZNE1ETTVNSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/camarioca?bWMgOTAgdiBjcmFjayBwdWxsbWM=fatale&overproduce.oversleeping=resurgence PDF link annotation

  • https://stormy-peak-45842.herokuapp.com/marpea.pdfIn PDF document text
  • https://arlingtonliquorpackagestore.com/ambient-design-artrage-5-0-5-x86-x64-key-cracksnow-serial-key-keygenl-link/In PDF document text
  • https://qeezi.com/advert/winthruster-hot-crack-activation-product-key-full-version-2019/In PDF document text
  • https://www.vakantiehuiswinkel.nl/download-cs-1-6-hack-aimbot-new/In PDF document text
  • https://sportingtip.com/alucobond-sz-20-dwg/In PDF document text
  • https://onemorelure.com/featured/cybersky-5-0-2-crack-rar-repack/In PDF document text
  • https://kasbocurrency.com/wp-content/uploads/2022/09/Uplay_Far_Cry_4_Crack_BEST_Ali213.pdfIn PDF document text
  • https://tranquil-brook-14524.herokuapp.com/haledanc.pdfIn PDF document text
  • https://templobiblicoprovidence.org/labelmatrix87upd-crack/In PDF document text
  • https://www.apokoronews.gr/advert/mobitec-icu-600-software-35-link/In PDF document text
  • https://mariana-flores-de-camino.com/mariana-flores-de-camino/sprint-layout-6-0-download-top-free-torrent/In PDF document text
  • https://changehealthfit.cz/wp-content/uploads/2022/09/arcgis_desktop_93_download_crack.pdfIn PDF document text
  • https://warm-woodland-34809.herokuapp.com/XilisoftVideoConverterUltimatev50980725IncKeygensnd_Serial_K.pdfIn PDF document text
  • https://www.cubius.fr/sketchup-pro-2019-19-2-222-60-crack-with-activation-key-free-top-download/In PDF document text
  • http://awaazsachki.com/?p=71244In PDF document text
  • https://www.ilmercatinodelleofferte.it/wp-content/uploads/2022/09/Delta_Horizon_Download_Setup_Compressed_2021.pdfIn PDF document text
  • http://saddlebrand.com/wp-content/uploads/2022/09/marcsaj.pdfIn PDF document text
  • https://talentoazul.cl/wp-content/uploads/2022/09/VMware_VSphere_Hypervisor_ESXi_5501331820_X86_64_ISO_2013_Download_TOP.pdfIn PDF document text
  • https://istud.in/wp-content/uploads/2022/09/Nisarga_Raja_Mp3_Song_Free_Download_FULL.pdfIn PDF document text
  • https://globaltechla.com/z3x-samsung-tool-pro-39-2-crack-without-box-full-setup-repack/In PDF document text
  • https://arlingtonliquorpackagestore.com/ambient-design-In PDF document text
  • https://qeezi.com/advert/winthruster-hot-crack-activation-product-In PDF document text
  • https://www.vakantiehuiswinkel.nl/download-cs-1-6-hack-aimbot-In PDF document text
  • https://kasbocurrency.com/wp-In PDF document text
  • https://www.apokoronews.gr/advert/mobitec-In PDF document text
  • https://mariana-flores-de-camino.com/mariana-flores-de-In PDF document text
  • https://changehealthfit.cz/wp-In PDF document text
  • https://warm-woodland-34809.herokuapp.com/XilisoftVideoConverteIn PDF document text
  • https://www.cubius.fr/sketchup-pro-2019-19-2-222-60-crack-with-In PDF document text
  • https://www.ilmercatinodelleofferte.it/wp-content/uploads/2022/09/In PDF document text
  • https://talentoazul.cl/wp-content/uploads/2022/09/VMware_VSphereIn PDF document text
  • https://istud.in/wp-content/uploads/2022/09/Nisarga_Raja_Mp3_SongIn PDF document text
  • https://globaltechla.com/z3x-samsung-tool-pro-39-2-crack-without-In PDF document text
  • http://dormister.com/agreeing/zg93bmxvywr8dzlwtm05mk0zedhnvfkytwpzne1ettvnshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda/camarioca?bwmgotagdibjcmfjaybwdwxsbwm=fatale&overproduce.oversleeping=resurgenceIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.