Malicious PDF / .BIN — malware analysis report

Heuristics 3

• PDF link embeds a government domain inside an unrelated host high PDF_PUBLIC_SECTOR_HOST_IMPERSONATION_LINK
  PDF contains a clickable URL where a government-style domain such as gov.xx appears as left-side host labels but the real registered domain is different. This deceives readers who scan the beginning of the hostname and is common in public-sector themed phishing lures.
• Image-only PDF lure with a single link to a non-reputable host medium PDF_IMAGE_LURE_NONREPUTABLE_LINK
  PDF is image-heavy with little real text and its only clickable action is a single external link to a host that is not known-good. This is the canonical malspam carrier shape — a screenshot-like 'click to view' page whose sole purpose is to funnel the victim to one redirect/landing URL on a compromised or throwaway domain. Flagged suspicious rather than malicious because the link alone (no shortener / typosquat / brand path) is the only corroborator beyond the image lure.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jkpolice.gov.in.kashmirattack.exposed/service/home/ In PDF document text

  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • https://docs.microsoft.com/typography/abouthttp://lucasfonts.comMicrosoftIn PDF document text
  • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text
  • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn PDF document text
  • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In PDF document text
  • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aIn PDF document text
  • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0In PDF document text
  • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn PDF document text
  • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In PDF document text
  • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^In PDF document text
  • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��In PDF document text
  • http://www.microsoft.com/pkiops/docs/primarycps.htm0@In PDF document text
  • http://www.microsoft.com/TypographyIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.