Malicious PDF — malware analysis report

Heuristics 6

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
  Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
• Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
  Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://dawnloadonline.com/ZG93bmxvYWR8OFVjWkhwdGFIeDhNVFkxTnpFNE5qazFOWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/schulman.adaptive/bopper.doens/atypy.TGJwODEwIFIxMTAgVjExMCBXaW4gWDY0IEVuIDdleGUgNDATGJ.paratroops PDF link annotation

  • https://domainmeans.com/buddha-dll-download-fixed-for-hitman-absolution/In PDF document text
  • http://slimancity.com/upload/files/2022/07/pY1i9zpi3xiKS3Kf5L9o_08_9892d9e78eaf39b7ae1e820c60845f7f_file.pdfIn PDF document text
  • https://ictlife.vn/upload/files/2022/07/RCsfSZxJlpj1ftsqRcEo_08_3807c7bd66b7ae3e230f81f74e3b7028_file.pdfIn PDF document text
  • https://greengrovecbd.com/blog/electromagnetic-fields-wangsness-solution-manual-2021/In PDF document text
  • https://oknit.ru/wp-content/uploads/2022/07/Knjiga_Zavoli_Bolest_Svoju_Pdf_Download16_LINK.pdfIn PDF document text
  • https://thecryptobee.com/bleach-circle-eden-mayuri-6-12/In PDF document text
  • https://mandarinrecruitment.com/system/files/webform/kaumanf791.pdfIn PDF document text
  • http://classacteventseurope.com/wp-content/uploads/2022/07/free_download_torrent_for_Special_26_movie_in_hindi_720p-1.pdfIn PDF document text
  • https://www.voyavel.it/duke-nukem-forever-trainer-razor-1911-keygen-new/In PDF document text
  • https://www.promorapid.com/upload/files/2022/07/icTAhM1MqSZmHpPoCzXB_08_3807c7bd66b7ae3e230f81f74e3b7028_file.pdfIn PDF document text
  • http://www.bayislistings.com/vueminder-calendar-ultimate-2018-00-portable-high-quality-keygen/In PDF document text
  • https://ja-zum-leben.de/wp-content/uploads/2022/07/xylwall.pdfIn PDF document text
  • https://dokilink.com/sites/dokilink.com/files/webform/arin/truepiano-194-keygen.pdfIn PDF document text
  • https://www.nextiainfissi.it/2022/07/08/rebarcad-v9-01-top-keygen/In PDF document text
  • https://delcohempco.com/2022/07/07/ls-magazine-issue-14-everything-about-me-set-torrent-download-verified/In PDF document text
  • https://matecumberesort.net/wp-content/uploads/2022/07/Heropanti_Movie_Download_In_Hd_1080p_BEST.pdfIn PDF document text
  • https://chatbook.pk/upload/files/2022/07/KcWUiMDJuacIyXjfKQRh_08_3b6d40640a62619d2254135e83abeb11_file.pdfIn PDF document text
  • https://h-stop.com/wp-content/uploads/2022/07/Cara_Membuka_Password_Rar_Dengan_Cmd.pdfIn PDF document text
  • https://heidylu.com/orient-bear-rasim-14/In PDF document text
  • http://slimancity.com/upload/files/2022/07/pY1i9zpi3xiKS3Kf5L9o_08_9892d9e78eaf39b7ae1e820c60In PDF document text
  • https://ictlife.vn/upload/files/2022/07/RCsfSZxJlpj1ftsqRcEo_08_3807c7bd66b7ae3e230f81f74e3b702In PDF document text
  • http://classacteventseurope.com/wp-In PDF document text
  • https://www.promorapid.com/upload/files/2022/07/icTAhM1MqSZmHpPoCzXB_08_3807c7bd66b7ae3In PDF document text
  • https://delcohempco.com/2022/07/07/ls-magazine-issue-14-everything-about-me-set-torrent-In PDF document text
  • https://matecumberesort.net/wp-In PDF document text
  • https://chatbook.pk/upload/files/2022/07/KcWUiMDJuacIyXjfKQRh_08_3b6d40640a62619d2254135e8In PDF document text
  • http://classacteventseurope.com/wp-content/uploads/2022/07/free_download_torrent_for_special_26_movie_in_hindi_720p-1.pdfIn PDF document text
  • https://heidylu.coIn macro / runtime command snippet
  • https://trello.com/c/2g4ALCY9/139-selvicoltura-generale-piussi-pdf-download-fixedIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.