Malicious PDF — malware analysis report

Heuristics 7

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://signforcover.com/ctro/pastiche/india/ZG93bmxvYWR8am01YUhKcU9IeDhNVFkxT0RJeE9EazROWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/newsgathering/TGluZWFyIEludGVncmFsIEVxdWF0aW9ucyBCeSBTaGFudGkgU3dhcnVwIFBkZiBEb3dubG9hZATGl.skirting?philosophy= PDF link annotation

  • http://bookmanufacturers.org/dx-ball-2-game-free-download-full-version-for-pc-newIn PDF document text
  • https://eshopper.info/grammar-in-use-intermediate-mp3/In PDF document text
  • https://matzenab.se/wp-content/uploads/2022/07/Trainz_Modula_City_V30_2010_PC_torrentrar.pdfIn PDF document text
  • https://www.gift4kids.org/wp-content/uploads/2022/07/joneyuse.pdfIn PDF document text
  • http://thenexteverything.com/wp-content/uploads/2022/07/pes_2010_editor_v2_become_legend_download.pdfIn PDF document text
  • https://parsiangroup.ca/2022/07/islamiat-notes-in-urdu-for-bsc-pdf-96-better/In PDF document text
  • https://www.nos-artisans-createurs.com/wp-content/uploads/2022/07/eirmark.pdfIn PDF document text
  • https://www.eeimi.com/wp-content/uploads/2022/07/1658758666-493d9807f5114a5.pdfIn PDF document text
  • https://innovacioncosmetica.com/wp-content/uploads/2022/07/Skylanders_No_Cd_Crack_BETTER_Pc.pdfIn PDF document text
  • https://lasdocas.cl/atlantis-pearls-of-the-deep-full-precracked-foxy-games-unlimited-gems-link/In PDF document text
  • http://www.chandabags.com/wp-content/uploads/2022/07/strata_foto_3d_cx2rar.pdfIn PDF document text
  • https://hermsnature.com/wp-content/uploads/2022/07/Him_Sarina_Bowen_Pdf.pdfIn PDF document text
  • https://fortworth-dental.com/davids-ultimate-boot-cd-2-0-4in1-exclusive-download/In PDF document text
  • https://6v9x.com/bioquimica-mckee-5ta-edicion-pdf-53-hot/In PDF document text
  • http://goldeneagleauction.com/?p=60235In PDF document text
  • https://www.benjaminsimonlohezic.com/aragami-gog-cheat-engine/In PDF document text
  • http://steamworksedmonton.com/davinci-resolve-16-0-keygen-hot/In PDF document text
  • https://www.vclouds.com.au/data-becker-arquitecto-3d-7-0-crack-hoted/In PDF document text
  • https://bloomhomeeg.com/wp-content/uploads/2022/07/Shree_Serial_Zee_Tv_Videos-1.pdfIn PDF document text
  • http://www.ressn.com/vlc-media-player-7-8-8-x86-x64-final-portable/In PDF document text
  • http://signforcover.com/ctro/pastiche/india/zg93bmxvywr8am01yuhkcu9iedhnvfkxt0rjee9eazrowhg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda/newsgathering/tgluzwfyieludgvncmfsievxdwf0aw9ucybcesbtagfudgkgu3dhcnvwifbkzibeb3dubg9hzatgl.skirting?philosophy=In PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.