Malicious PDF — malware analysis report

Heuristics 7

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
  Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://emailgoal.com/ZG93bmxvYWR8bjZQTW5seWRIeDhNVFkyTWpZNE1ETTVNSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA?borneo=&dyskinesia=welding&marnus=Tm9ydG9uIERpc2sgRG9jdG9yIDIwMDcgUG9ydGFibGUucmFyTm9&buffy=oostindische PDF link annotation

  • https://fortworth-dental.com/wp-content/uploads/2022/09/ellsgard.pdfIn PDF document text
  • http://getpress.hu/wp-content/uploads/2022/09/Visution-MAPIO-Pro-2312849-Crack-Full.pdfIn PDF document text
  • https://ikcasino.com/2022/09/09/total-video-converter-3-12-full-cracked-free-link-download/In PDF document text
  • https://floating-cove-68645.herokuapp.com/Three_meters_above_the_sky_2_english_torrent.pdfIn PDF document text
  • http://www.tunlive.com/wp-content/uploads/juaparl.pdfIn PDF document text
  • https://duolife.academy/acronis-trueimage-enterprise-server-9-1-3854-with-universal-rest-serial-key/In PDF document text
  • http://greenteam-rds.com/?p=54582In PDF document text
  • http://buyfitnessequipments.com/?p=37658In PDF document text
  • http://www.prokaivos.fi/wp-content/uploads/thomarm.pdfIn PDF document text
  • https://shahjalalproperty.com/wp-content/uploads/2022/09/sabfau.pdfIn PDF document text
  • https://mentoring4good.com/wp-content/uploads/2022/09/yulekae.pdfIn PDF document text
  • http://leasevoordeel.be/wp-content/uploads/2022/09/aversan.pdfIn PDF document text
  • https://mdotm.in/easy-worship-song-database-download-better/In PDF document text
  • https://bbv-web1.de/wirfuerboh_brett/advert/1-nenokkadine-movie-download-best-blu-ray-rip-moviesinstmank/In PDF document text
  • https://ventanasantiruido.info/2022/09/09/ygopro-ai-mode-download-new/In PDF document text
  • https://gentle-shore-18732.herokuapp.com/tricaster_studio_free_software.pdfIn PDF document text
  • https://murmuring-river-83664.herokuapp.com/solarwinds_engineers_toolset_v10_keygen.pdfIn PDF document text
  • https://securetranscriptsolutions.com/wp-content/uploads/2022/09/G_Code_Download_Cnc_Pdf.pdfIn PDF document text
  • http://www.elstar.ir/wp-content/uploads/2022/09/HACK_Advanced_PDF_Password_Recovery_Professional_310.pdfIn PDF document text
  • http://www.chandabags.com/intermediate-microeconomics-varian-workout-solutions-rar-checked/In PDF document text
  • https://bbv-web1.de/wirfuerboh_brett/advert/1-nenokkadine-movie-download-best-blu-ray-rip-In PDF document text
  • http://www.elstar.ir/wp-In PDF document text
  • http://emailgoal.com/zg93bmxvywr8bjzqtw5sewriedhnvfkytwpzne1ettvnshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda?borneo=&dyskinesia=welding&marnus=tm9ydg9uierpc2sgrg9jdg9yidiwmdcgug9ydgfibguucmfytm9&buffy=oostindischeIn PDF document text
  • http://getpress.hu/wp-content/uploads/2022/09/visution-mapio-pro-2312849-crack-full.pdfIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.