Malicious PDF — malware analysis report

Heuristics 5

• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://evacdir.com/botulism.ZG93bmxvYWR8M29MT0RacFozeDhNVFkzTWpVNU1qVTNOSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/economy/UGhvdG9zaG9wIDIwMjEgKHZlcnNpb24gMjIpUGh.unhelpful/gallons/indubitably.mouthed PDF link annotation

  • http://evacdir.com/botulism.zg93bmxvywr8m29mt0racfozedhnvfkztwpvnu1qvtnoshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda/economy/ughvdg9zag9widiwmjegkhzlcnnpb24gmjipugh.unhelpful/gallons/indubitably.mouthedIn PDF document text
  • https://soundcloud.com/bullosketawak/auto-data-german-338-downloadIn PDF document text
  • https://soundcloud.com/ivanvdndor/borland-c-builder-6-con-crack-jgmm-64-bitIn PDF document text
  • https://soundcloud.com/kuruelinkerim/wip-nav-peugeot-alert-zone-torrent-downloadlIn PDF document text
  • https://soundcloud.com/nikitababvu/solucionario-de-curso-de-fisica-moderna-virgilio-acostararIn PDF document text
  • https://soundcloud.com/iljijaweselyq/free-download-sql-server-2012-enterprise-edition-full-versionrarIn PDF document text
  • https://soundcloud.com/ivanvdndor/vector-magic-desktop-edition-115-keygen-macIn PDF document text
  • https://soundcloud.com/fatanbawuroc/genial-klick-a1-pdf-16In PDF document text
  • https://soundcloud.com/sizahiders1972/mon-ami-3000-crack-downloadIn PDF document text
  • https://soundcloud.com/bullosketawak/metro-2033-trainer-1001In PDF document text
  • https://soundcloud.com/cessnatege1983/sap2000-v15-crack-only-free-downloadIn PDF document text
  • http://dejavu.sourceforge.netIn extracted file (stream_006_off00004201.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (stream_006_off00004201.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.