Malicious PDF — malware analysis report

Heuristics 6

• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• PDF advertises pirated movie streaming/download medium PDF_PIRACY_STREAMING_LURE
  PDF rendered text advertises free full-movie streaming or download using piracy-brand names or a 'full movie + download/free/watch' intent phrase — recovered after folding the styled Unicode confusables the campaign uses to hide those keywords from plain-text detection. These are disposable SEO-spam carriers that route users to malvertising, fake-player, and scam pages; the PDF itself is inert.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://evacdir.com/ZG93bmxvYWR8bkY0TW1oaU5IeDhNVFkxTkRnNU16RTVNWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/bizzare/gopuras.fossilization?kheops=retune&ZG93bmxvYWQgUmFtYXlhbmEgLSBUaGUgRXBpYyBmdWxsIG1vdmllIGhkIDEwODBwZG9=perignon.stealer PDF link annotation

  • https://wheeoo.org/upload/files/2022/06/8CcSVwfTqrSg2f4sIU8P_10_216d12a6f78ce44b7cf96df15567e17e_file.pdfIn PDF document text
  • https://wozyzy.com/upload/files/2022/06/P57xh7Dxid1oWpRcjIYP_10_5a108b37ffefd9c48716fb0c61e4326f_file.pdfIn PDF document text
  • https://lawnsaverproducts.com/wp-content/uploads/2022/06/Iconico_Screen_Protractor_Serial_Numberl.pdfIn PDF document text
  • https://cupcommunity.com/wp-content/uploads/2022/06/PatternMaker_Marker_Studio_V705_Build_rar.pdfIn PDF document text
  • https://www.corsisj2000.it/sexy-venera-site-rip-fulltrmdsf/In PDF document text
  • https://evi-shop.vn/upload/files/2022/06/BBJUWUO51vEiRF8Z1fF4_10_fb95000fcc2064382a65c3174b25ea68_file.pdfIn PDF document text
  • https://steauction.com/wp-content/uploads/2022/06/Aiseesoft_Total_Video_Converter_Platinum_7126_ChingLiu_Keygen.pdfIn PDF document text
  • http://fokusparlemen.id/?p=18190In PDF document text
  • http://saddlebrand.com/?p=15003In PDF document text
  • http://clubonlineusacasino.com/download-buku-kalkulus-edisi-5-jilid-1-purcell/In PDF document text
  • https://karydesigns.com/wp-content/uploads/2022/06/sanjew.pdfIn PDF document text
  • https://sltechraq.com/wp-content/uploads/2022/06/pansagr.pdfIn PDF document text
  • https://salty-escarpment-46567.herokuapp.com/yakewel.pdfIn PDF document text
  • https://shielded-shelf-30046.herokuapp.com/ozureliz.pdfIn PDF document text
  • https://hookercafe.com/wp-content/uploads/2022/06/Sound_Rescue_Terratec_Edition_21_Crack.pdfIn PDF document text
  • https://diversityforum.net/wp-content/uploads/2022/06/Wondershare_PDFelement_Pro_6803523_Crack_Product_Key_Free.pdfIn PDF document text
  • https://dashiofficial.com/wp-content/uploads/2022/06/ghilger.pdfIn PDF document text
  • https://fumostoppista.com/download-crack-for-tekla-19/In PDF document text
  • https://fumostoppista.com/wp-content/uploads/2022/06/Printeradmin_Print_Job_Manager_90_Crack.pdfIn PDF document text
  • https://social111.s3.amazonaws.com/upload/files/2022/06/M5xaFflBWAGZlinSdCNo_10_216d12a6f78ce44b7cf96df15567e17e_file.pdfIn PDF document text
  • http://evacdir.com/zg93bmxvywr8bky0tw1oau5iedhnvfkxtkrnnu16rtvnwhg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda/bizzare/gopuras.fossilization?kheops=retune&zg93bmxvywqgumftyxlhbmeglsbuagugrxbpyybmdwxsig1vdmllighkidewodbwzg9=perignon.stealerIn PDF document text
  • https://diversityforum.net/wp-content/uploads/2022/06/wondershare_pdfelement_pro_6803523_crack_product_key_free.pdfIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.