Malicious PDF — malware analysis report

Heuristics 7

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
  PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
• Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
  Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://seachtop.com/enchants/?implemantation=overviewed.TmV0c3BvdCBQcm8gRnVsbCBDcmFjayAyMgTmV.ZG93bmxvYWR8WHg2T1RGMmRueDhNVFkyT1RnMk1qSTRObng4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/burrill.patshull PDF link annotation

  • https://curtadoc.tv/wp-content/uploads/2022/12/nirerbu.pdfIn PDF document text
  • http://efekt-metal.pl/?p=1In PDF document text
  • https://azizeshop.com/wp-content/uploads/2022/12/Literary_Devices_In_The_Poem_Miracles_By_Walt_Whitman.pdfIn PDF document text
  • https://tribetotable.com/wp-content/uploads/2022/12/latchah.pdfIn PDF document text
  • https://www.wangfuchao.com/wp-content/uploads/2022/12/Prog12z_Programmer_V_167_EXCLUSIVE.pdfIn PDF document text
  • https://freecricprediction.com/wp-content/uploads/2022/12/rajashivchatrapatibookbybabasahebpurandarepdfdownload.pdfIn PDF document text
  • https://mentorus.pl/naukrani-ka-doodh-piya-hindi-pdf-sex-story-blumentopf-teamspeak/In PDF document text
  • https://eveningandmorningchildcareservices.com/wp-content/uploads/2022/12/CATIA_V5R21_Crack_JSOGROUPdllrar_INSTALL.pdfIn PDF document text
  • http://www.standardnews.in/wp-content/uploads/2022/12/aryaflli.pdfIn PDF document text
  • https://epochbazar.com/wp-content/uploads/2022/12/villu_tamil_movie_hd_downloads.pdfIn PDF document text
  • https://azizeshop.com/wp-content/uploads/2022/12/Literary_Devices_In_The_Poem_Miracles_By_In PDF document text
  • https://www.wangfuchao.com/wp-content/uploads/2022/12/Prog12z_Programmer_V_167_EXCLUIn PDF document text
  • https://freecricprediction.com/wp-content/uploads/2022/12/rajashivchatrapatibookbybabasahebpIn PDF document text
  • https://eveningandmorningchildcareservices.com/wp-content/uploads/2022/12/CATIA_V5R21_CraIn PDF document text
  • http://seachtop.com/enchants/?implemantation=overviewed.tmv0c3bvdcbqcm8grnvsbcbdcmfjayaymgtmv.zg93bmxvywr8whg2t1rgmmruedhnvfkyt1rnmk1qstrobng4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda/burrill.patshullIn PDF document text
  • http://dejavu.sourceforge.netIn extracted file (stream_005_off00002e90.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (stream_005_off00002e90.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.