Malicious PDF — malware analysis report

Heuristics 7

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
  Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://evacdir.com/broxton/chang/ZG93bmxvYWR8a3czT0hSNVlueDhNVFkxTlRnME1qazRNWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/encapsulate=geometry/SXN1bXNvZnQgWmlwIFBhc3N3b3JkIFJlZml4ZXIgMy4xIDEgU2VyaWFsIEtleQSXN?directorship=paralleled PDF link annotation

  • http://babussalam.id/?p=12741In PDF document text
  • https://authorwbk.com/wp-content/uploads/2022/06/premalf.pdfIn PDF document text
  • http://barrillos.org/2022/06/22/__link__-xforce-keygen-64-bit-fbx-2017-key/In PDF document text
  • https://afternoon-meadow-26007.herokuapp.com/Serious_Sam_2_Full_No_CD_Crack.pdfIn PDF document text
  • https://www.icmgpartners.com/wp-content/uploads/2022/06/Istoria_Lui_Razvan_Pdf_Download_LINK.pdfIn PDF document text
  • https://www.easyblogging.in/wp-content/uploads/2022/06/MAGIX_Music_Maker_MX_Premium_180042.pdfIn PDF document text
  • http://humlog.social/upload/files/2022/06/hcTMXH8gfqgwUvkhOjOr_22_8a75cb343c01f06205d83946028bac5c_file.pdfIn PDF document text
  • https://rko-broker.ru/2022/06/22/elmer-mcgantt-morning-musings/In PDF document text
  • https://www.repaintitalia.it/paypal-money-adder-password-free-crack/In PDF document text
  • https://gamersmotion.com/utilio/In PDF document text
  • https://frustratedgamers.com/upload/files/2022/06/EO3vmbJHIFIXRWm2ZeeD_22_22cd6bb64241dbc43e67421d3478e0ea_file.pdfIn PDF document text
  • https://tucorsetera.com/wp-content/uploads/2022/06/lazkal.pdfIn PDF document text
  • http://adomemorial.com/2022/06/22/autodesk-license-key-previous-next/In PDF document text
  • https://delicatica.ru/2022/06/22/korean-language-learning-in-bangla-pdf-repack-free-207/In PDF document text
  • https://www.jatjagran.com/wp-content/uploads/Pavlov_VR_Update_151_Hack_Tool_Download.pdfIn PDF document text
  • https://www.thesmilecraft.com/wp-content/uploads/2022/06/Tecnologia_9_Cristina_Bonardipdf.pdfIn PDF document text
  • https://lordwillprovide.com/wp-content/uploads/2022/06/gaspalb.pdfIn PDF document text
  • https://evening-ravine-75124.herokuapp.com/E_N_V_O_Y_FILME_dublado.pdfIn PDF document text
  • http://evacdir.com/broxton/chang/zg93bmxvywr8a3czt0hsnvluedhnvfkxtlrnme1qazrnwhg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda/encapsulate=geometry/sxn1bxnvznqgwmlwifbhc3n3b3jkifjlzml4zxigmy4xidegu2vyawfsietleqsxn?directorship=paralleledIn PDF document text
  • http://goodidea.altervista.org/advert/corpus-christi-girlfriends-2/In PDF document text
  • https://paperpage.sgp1.digitaloceanspaces.com/upload/files/2022/06/mU4RWogsImggBK9fs3Lw_22_8a75cb343c01f06205d83946028bac5c_file.pdfIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.