Malicious PDF — malware analysis report

Heuristics 7

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://rocketcarrental.com/bnlpbWJvY2lha3VpbmlyYW5nYWlwZGZkb3dubG9hZAbnl/netvines/ZG93bmxvYWR8ZWIzWVRFMWZId3hOalU0TWpFNE9UZzFmSHd5TlRrd2ZId29UU2tnVjI5eVpIQnlaWE56SUZ0WVRVeFNVRU1nVmpJZ1VFUkdYUQ/conventiclers.coversion/lope/fake?peopled PDF link annotation

  • https://www.pooldone.com/patch-12-2-2-football-manager-2012-crack-new/In PDF document text
  • https://www.chimfab.com/wp-content/uploads/2022/07/Despertar_Del_Cementerio_Version_8_Download_FREE.pdfIn PDF document text
  • https://koeglvertrieb.de/wp-content/uploads/2022/07/virnquah.pdfIn PDF document text
  • http://www.giffa.ru/who/revisionfx-twixtor-pro-7-2-1-for-ae-cracked-vr-keygen-hot/In PDF document text
  • https://h-stop.com/wp-content/uploads/2022/07/quevyvy.pdfIn PDF document text
  • https://dronezone-nrw.2ix.de/advert/crack-no-cd-la-bataille-pour-la-terre-du-milieu-2-high-quality/In PDF document text
  • https://drmanishhinduja.com/2022/07/24/farruca-sabicas-partitura-pdf-17-exclusive/In PDF document text
  • https://maltmarketing.com/advert/hd-online-player-i-want-you-2012-english-subtitles-72/In PDF document text
  • https://intrendnews.com/wp-content/uploads/2022/07/tagithor.pdfIn PDF document text
  • https://africanscientists.africa/wp-content/uploads/2022/07/Descargar_Discografia_Completa_De_Junior_Klan_Torrent_EXCLUSIVE-1.pdfIn PDF document text
  • https://slitetitle.com/wp-content/uploads/2022/07/gabegild.pdfIn PDF document text
  • https://kooperativakosjeric.rs/wp-content/uploads/2022/07/3d_girlz_2_unlock_code.pdfIn PDF document text
  • http://eventaka.com/?p=39793In PDF document text
  • https://xn--80aagyardii6h.xn--p1ai/va-kuschel-rock-collection-vol121-19892008-better/In PDF document text
  • https://vendredeslivres.com/wp-content/uploads/2022/07/jeazim.pdfIn PDF document text
  • http://yotop.ru/2022/07/25/native-instruments-vari-comp-v1-1-1-update-r2r-deepstatus-repack-crack/In PDF document text
  • http://teignvalleypedalbashers.co.uk/advert/dead-rising-3-apocalypse-edition-update-5-pc-gameIn PDF document text
  • https://www.velocitynews.co.nz/advert/nitgen-access-manager-serial-number-__exclusive__/In PDF document text
  • https://xn--80aagyardii6h.xn--p1ai/microsoft-office-2016-pro-plus-16-0-4266-1001-vl-x64-download-__full__/In PDF document text
  • http://cyclades.in/en/?p=128457In PDF document text
  • http://rocketcarrental.com/bnlpbwjvy2lha3vpbmlyyw5nywlwzgzkb3dubg9hzabnl/netvines/zg93bmxvywr8zwizwvrfmwzid3hoalu0twpfne9uzzfmshd5tlrrd2zid29uu2tnvji5evpiqnlawe56suz0wvrvefnvru1nvmpjz1vfukdyuq/conventiclers.coversion/lope/fake?peopledIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.