Malicious PDF — malware analysis report

Heuristics 6

• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://xtraserp.com/ZG93bmxvYWR8MlFaT0dSd2FIeDhNVFkxTnpFNE5qazFOWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA.internazionale?kettenbr=&koerner=/mimulus/rawk/inventories.cHVibGljIHNlcnZpY2UgYm94IGNpdHJvZW4gY29tcHV PDF link annotation

  • https://www.tnrhcp.com/__full__-crack-coreldraw-graphics-suite-x5-psikey-dll/In PDF document text
  • https://www.mil-spec-industries.com/system/files/webform/swarabitan-free-download.pdfIn PDF document text
  • https://ghanarave.com/wp-content/uploads/2022/07/Nokia_Best_Bb5_Easy_Service_Tool_188_Crackl.pdfIn PDF document text
  • https://shielded-reaches-68962.herokuapp.com/quihamm.pdfIn PDF document text
  • https://peaceful-chamber-30463.herokuapp.com/jamequar.pdfIn PDF document text
  • https://www.mil-spec-industries.com/system/files/webform/valetam185.pdfIn PDF document text
  • https://ilpt.com/system/files/webform/The-Thieves-Korean-Movie-Download-English-Subtitles.pdfIn PDF document text
  • https://amedirectory.com/wp-content/uploads/2022/07/Download_2021_Dt07img_Pes_2013_139.pdfIn PDF document text
  • https://www.lisbonct.com/sites/g/files/vyhlif791/f/news/newsletterfall2019.pdfIn PDF document text
  • https://silkfromvietnam.com/adobe-photoshop-cc-2018-v19-1-7-16293-x64-crack-cracksmind-portable/In PDF document text
  • https://www.yflyer.org/advert/full-best-adobe-acrobat-pro-dc-2015-010-20060-multilingual-crack-sadeem/In PDF document text
  • http://gobigup.com/?p=17604In PDF document text
  • http://tutorialspointexamples.com/ben-johnson-malayalam-movie-free-download-exclusiveIn PDF document text
  • http://infoimmosn.com/?p=18372In PDF document text
  • https://www.rentbd.net/security-monitor-pro-51-serial-number-keygen-__top__/In PDF document text
  • https://www.townofholliston.us/sites/g/files/vyhlif706/f/uploads/town_department_office_hours.pdfIn PDF document text
  • https://evening-peak-56584.herokuapp.com/reebyan.pdfIn PDF document text
  • http://www.residence-universitaire-lanteri.com/sites/default/files/webform/naylaur210.pdfIn PDF document text
  • https://www.riobrasilword.com/2022/07/07/pembahasan-kalkulus-jilid-1-purcell-edisi-5-19-free/In PDF document text
  • https://stormy-springs-62132.herokuapp.com/solucionario_de_fisica_vectorial_tomo_2_gratis_de_vallejo_za.pdfIn PDF document text
  • http://xtraserp.com/zg93bmxvywr8mlfat0dsd2fiedhnvfkxtnpfne5qazfowhg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda.internazionale?kettenbr=&koerner=/mimulus/rawk/inventories.chvibgljihnlcnzpy2ugym94ignpdhjvzw4gy29tchvIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.