Malicious PDF — malware analysis report

Heuristics 4

• Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
  Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
• PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
  PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://getpdf.pw/book?res=123&isbn=9780813141596&kwd=Hoax%20:%20Hitlers%20Diaries,%20Lincolns%20Assassins,%20and%20Other%20Famous%20Frauds PDF link annotation

  • https://static.s123-cdn.com/uploads/4660128/normal_61af8a64048dc.pdfIn PDF document text
  • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off0000f6fa.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.