Malicious PDF — malware analysis report

Heuristics 9

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF links to a cracked-software download doorway (base64-obfuscated) high PDF_CRACKED_SOFTWARE_DOWNLOAD_DOORWAY
  PDF's embedded link hides a pirated-software title as a base64 blob inside the URL path/query (and/or carries the ``download|`` doorway-template marker), rather than in visible text. This is a TCPDF-generated SEO doorway that ranks for software-piracy searches and funnels users to fake 'crack/keygen' download pages distributing adware, potentially-unwanted programs, or droppers. The base64 encoding is deliberate obfuscation to evade plaintext lure rules; the PDF itself carries no parser exploit — the risk is the linked crack-download destination.
• Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
  Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://evacdir.com/fomentation.allspywarefree?ZG93bmxvYWR8QnI5TkRVMmZId3hOalUxTXpNMU1UZ3hmSHd5TlRrd2ZId29UU2tnVjI5eVpIQnlaWE56SUZ0WVRVeFNVRU1nVmpJZ1VFUkdYUQ=hydrating.memorable.goldilocks.proximal&c2NhcmljYXJlIEFydENBTSAyMDEyIGNyYWNrIDY0IGJpdHMgSXRhbGlhbm8c2N=sugarcoating PDF link annotation

  • https://wmondemand.com/?p=11285In PDF document text
  • http://www.babel-web.eu/p7/corel-paintshop-pro-2020-v22-2-0-8-full-crack-free-download-upd/In PDF document text
  • http://www.vidriositalia.cl/wp-content/uploads/2022/06/Ndrive_V11_Pna.pdfIn PDF document text
  • https://www.rosatugores.com/wp-content/uploads/Kama_Suthraya_Sinhala_Pdf_LINK.pdfIn PDF document text
  • https://dubaifashionlux.com/2022/06/15/simatic-s7-cfc-v8-0/In PDF document text
  • https://rshop.in/wp-content/uploads/2022/06/inocviv.pdfIn PDF document text
  • https://fortymillionandatool.com/hot-descargar-videos-de-peliculas-porno-comprimidos-full-better/In PDF document text
  • https://obzorkuhni.ru/styling/nazrul-geeti-swaralipi-pdf-download101-portable/In PDF document text
  • https://trendenews.com/crack-premiumsoft-navicat-premium-v11-0-18-x86-x64-verified/In PDF document text
  • https://www.papershoot.com/wp-content/uploads/Emperor__Battle_For_Dune_PC_ENGLISH_ISO_Pc_Game-2.pdfIn PDF document text
  • https://recipe.de/wp-content/uploads/Adobe_Photoshop_CC_2018_20150529r88_32_64Bit_Crack_64_bit.pdfIn PDF document text
  • https://allsourceaffiliates.com/wp-content/uploads/2022/06/Enfermagem_Medico_Cirurgica_Phipps_Download_Pdf.pdfIn PDF document text
  • https://sugaringspb.ru/corel-videostudio-pro-x2-v12-0-98-0-key-rar-upd/In PDF document text
  • https://baseheadinc.com/wp-content/uploads/2022/06/Autodesk_MotionBuilder_2020_Crack_License_Key_Free_Download.pdfIn PDF document text
  • https://meuconhecimentomeutesouro.com/educar-con-inteligencia-emocional-maurice-j-elias-pdf-download-repack/In PDF document text
  • http://mikunioz.com/wp-content/uploads/2022/06/Mohenjo_Daro_Movie_Download_In_Tamil_Dubbed_Movies.pdfIn PDF document text
  • https://resistanceschool.info/wp-content/uploads/2022/06/HD_Online_Player_id_works_65_serial_number.pdfIn PDF document text
  • https://teenmemorywall.com/porting-calculator-v4-2-2-bittorrent-__exclusive__/In PDF document text
  • https://nameme.ie/wp-content/uploads/2022/06/Sketchup_Pro_2014_Crack_Only_Nitro_VERIFIED.pdfIn PDF document text
  • https://srkvilaskodaikanal.com/2022/06/15/holiday-full-movie-2014-akshay-kumar-1080p-hd/In PDF document text
  • https://baseheadinc.com/wp-In PDF document text
  • http://evacdir.com/fomentation.allspywarefree?zg93bmxvywr8qni5tkrvmmzid3hoaluxtxpnmu1uz3hmshd5tlrrd2zid29uu2tnvji5evpiqnlawe56suz0wvrvefnvru1nvmpjz1vfukdyuq=hydrating.memorable.goldilocks.proximal&c2nhcmljyxjliefydenbtsaymdeyignyywnridy0igjpdhmgsxrhbglhbm8c2n=sugarcoatingIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.