Malicious PDF — malware analysis report

Heuristics 7

• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Viral-video clickbait PDF links to suspicious host critical SE_VIRAL_VIDEO_CLICKBAIT_LINK
  Document uses viral/leaked-video lure text and links to a suspicious disposable-looking web host. This is a clickbait/traffic-scam carrier shape rather than a benign PDF link.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF links to a cracked-software download doorway (base64-obfuscated) high PDF_CRACKED_SOFTWARE_DOWNLOAD_DOORWAY
  PDF's embedded link hides a pirated-software title as a base64 blob inside the URL path/query (and/or carries the ``download|`` doorway-template marker), rather than in visible text. This is a TCPDF-generated SEO doorway that ranks for software-piracy searches and funnels users to fake 'crack/keygen' download pages distributing adware, potentially-unwanted programs, or droppers. The base64 encoding is deliberate obfuscation to evade plaintext lure rules; the PDF itself carries no parser exploit — the risk is the linked crack-download destination.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://findthisall.com/cettap/ZG93bmxvYWR8UlozTVhacGNIeDhNVFkzTVRVME5qUXdOM3g4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/mine=eerily.dispersion?doughnut=UmFnaGF2IFNhY2hhciDigJMgT20gSmFpIEphZ2Rpc2ggWzIwMTAtTVAzLVZCUi0zMjBLYnBzXSDigJMgeERSUmF PDF link annotation

  • https://player.soundon.fm/p/Warcraft-3-Frozen-Throne-Download-Free-Full-V-hellIn PDF document text
  • https://player.soundon.fm/p/ArtCAM-2010-SP4-DVD-ISO-New-1009torrent-stagkorstyIn PDF document text
  • https://player.soundon.fm/p/ULEAD-PHOTOIMPACT-302-tertilyzigiIn PDF document text
  • https://player.soundon.fm/p/Displayname-Field-Missing-From-Registry-Sims--niteIn PDF document text
  • https://player.soundon.fm/p/Battlefield-2-Aix-Download-WORK-nebartseccardchosIn PDF document text
  • https://player.soundon.fm/p/Free-Download-License-Key-Noiseware-Professio-tiofIn PDF document text
  • https://player.soundon.fm/p/Rpp-Dan-Silabus-Bahasa-Inggris-Tata-Boga-Smk--litaIn PDF document text
  • https://player.soundon.fm/p/Gear-Template-Generator-Program-Torrent-TOP-sonnacIn PDF document text
  • https://immanuelglobalwp.com/wp-content/uploads/Fce-Use-Of-English-2-By-Virginia-Evans-Teachers-Book-15-2021.pdfIn PDF document text
  • https://myblogrepublika.com/wp-content/uploads/2022/12/Apocalypto-2006-In-Hindi-Dubbed-Hit-2021.pdfIn PDF document text
  • http://standoutfitness.com/?p=8598In PDF document text
  • https://brittanymondido.com/all-episodes-of-beyblade-season-1-cartoon-in-13/In PDF document text
  • https://www.mrfoodis.de/wp-content/uploads/2022/12/latisi.pdfIn PDF document text
  • https://friduchajewelry.ru/2022/12/21/autocad-mep-2010-64bit-product-key-and-xforce-keygen-rar-verified/In PDF document text
  • https://www.divinejoyyoga.com/wp-content/uploads/2022/12/helsala.pdfIn PDF document text
  • https://educationcollege.info/mard-4-full-movie-in-hindi-720p-free-better-download/In PDF document text
  • http://www.reiten-scheickgut.at/the-paper-kites-twelvefour-2015-18/In PDF document text
  • https://superalimentos.xyz/salamander-net-decompiler-v1-06l/In PDF document text
  • http://silent-arts.com/getdata-recover-my-files-v4-6-8-license-key-txt-new/In PDF document text
  • https://bmpads.com/2022/12/20/do-knot-disturb-1-2-3-720p-in-dual-audio-hindi-link/In PDF document text
  • https://theferosempire.com/?p=22239In PDF document text
  • https://turn-key.consulting/2022/12/20/la-noire-crack-only-_best_-download-games/In PDF document text
  • https://niceclipart.com/blood-orange-cupid-deluxe-rar-zip/In PDF document text
  • https://www.anunciandoinmuebles.com/wp-content/uploads/2022/12/georaudr.pdfIn PDF document text
  • http://newfashionbags.com/shima-seiki-sds-one-a56-dvd-rarshima-seiki-sds-one-a56-dvd-rar/In PDF document text
  • https://localdealmonster.com/wp-content/uploads/2022/12/Amostras-De-Videos-Novos-De-Zoofilia.pdfIn PDF document text
  • https://mindfullymending.com/cabaret-desire-2011-uncut-hot-download/In PDF document text
  • https://samtoysreviews.com/2022/12/20/wondershare-dvd-slideshow-builder-deluxe-3d-model-pack-registration-code-crack-best/In PDF document text
  • https://immanuelglobalwp.com/wp-content/uploads/Fce-Use-Of-English-2-By-Virginia-Evans-TeachersIn PDF document text
  • https://myblogrepublika.com/wp-content/uploads/2022/12/Apocalypto-2006-In-Hindi-Dubbed-Hit-202In PDF document text
  • https://friduchajewelry.ru/2022/12/21/autocad-mep-2010-64bit-product-key-and-xforce-keygen-rar-veIn PDF document text
  • https://samtoysreviews.com/2022/12/20/wondershare-dvd-slideshow-builder-deluxe-3d-model-pack-reIn PDF document text
  • http://findthisall.com/cettap/zg93bmxvywr8uloztvhacgniedhnvfkztvrvme5quxdom3g4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda/mine=eerily.dispersion?doughnut=umfnagf2ifnhy2hhcidigjmgt20gsmfpiephz2rpc2ggwziwmtattvazlvzcui0zmjblynbzxsdigjmgeersumfIn PDF document text
  • http://dejavu.sourceforge.netFontsIn extracted file (font_01_sfnt_off000071d6.bin)
  • http://dejavu.sourceforge.netIn extracted file (stream_004_off00003e20.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (stream_004_off00003e20.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseDejaVuIn extracted file (font_01_sfnt_off000071d6.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.