Malicious PDF — malware analysis report

Heuristics 7

• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• PDF advertises pirated movie streaming/download medium PDF_PIRACY_STREAMING_LURE
  PDF rendered text advertises free full-movie streaming or download using piracy-brand names or a 'full movie + download/free/watch' intent phrase — recovered after folding the styled Unicode confusables the campaign uses to hide those keywords from plain-text detection. These are disposable SEO-spam carriers that route users to malvertising, fake-player, and scam pages; the PDF itself is inert.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://esecuritys.com/ZnJlZSBkZWx1eCB3ZWJjYW0gZGx2IGI3MDUgZHJpdmVyZnJ/steptococcus/boneset.decline/ZG93bmxvYWR8R0s0YldkbWRYeDhNVFkxTmpjM01UZ3hPSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA.markups.fondle.reider PDF link annotation

  • https://balloonites.com/wp-content/uploads/2022/07/Yaarana_1981_Hindi_Full_Movie_Hd_Download.pdfIn PDF document text
  • https://jbmparish.com/gallery-format/cold-waters-activation-code-crack-__top__In PDF document text
  • https://discovery.info/astrology-software-free-download-full-version-in-urdu-link/In PDF document text
  • https://www.careerfirst.lk/sites/default/files/webform/cv/posnelw308.pdfIn PDF document text
  • http://www.ijisr.com/system/files/webform/article-files/Tableau-Desktop-Activation-Key.pdfIn PDF document text
  • https://studiolegalefiorucci.it/2022/07/03/smurfs-the-lost-village-english-3-full-link-movie-in-hindi-720p/In PDF document text
  • https://mandarinrecruitment.com/system/files/webform/cd-flaix-fm-20-anys-gratis.pdfIn PDF document text
  • https://clubtransitcustom.es/advert/download-patched-codevisionavr-26-full-version-with-crack/In PDF document text
  • https://instafede.com/andaz-1971-��-flac-repack/In PDF document text
  • https://www.cheddrbox.com/upload/files/2022/07/33FoCcV9jnXw6da2HsYV_03_2f9d86ab41bfebb3b8372bfbb2b53bf5_file.pdfIn PDF document text
  • https://p2p-tv.com/wp-content/uploads/2022/07/jolivet_bassoon_concerto_pdf_download.pdfIn PDF document text
  • https://obzorkuhni.ru/styling/windows-10-enterprise-2016-ltsb-x64-v5-lite-ivankehayov-serial-key-updated/In PDF document text
  • https://mentorus.pl/resharper-2019-1-2-hot-crack-with-registration-code-free-download/In PDF document text
  • https://www.tradebeusa.com/system/files/webform/attached_cv/en/algoritmos-y-estructuras-de-datos-niklaus-wirth-67.pdfIn PDF document text
  • https://fantasyartcomics.com/2022/07/03/dwgconvert-7-0-repack-crack/In PDF document text
  • http://automationexim.com/avid-sibelius-8-5-0-build-63-multilingual-crack-setup-hot-free/In PDF document text
  • https://www.golfmotion.co.nz/sites/default/files/webform/shanqua959.pdfIn PDF document text
  • https://bodhirajabs.com/download-pyaar-ka-punchnama-2-1080p-repack/In PDF document text
  • http://www.antiquavox.it/xforce-keygen-32bits-or-64bits-version-autocad-revit-lt-suite-2009-download-verified/In PDF document text
  • http://www.flyerbee.com/?p=179221In PDF document text
  • http://esecuritys.com/znjlzsbkzwx1ecb3zwjjyw0gzgx2igi3mdugzhjpdmvyznj/steptococcus/boneset.decline/zg93bmxvywr8r0s0yldkbwryedhnvfkxtmpjm01uz3hpshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda.markups.fondle.reiderIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.