Malicious PDF — malware analysis report

Heuristics 5

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• PDF links to a cracked-software download doorway (base64-obfuscated) high PDF_CRACKED_SOFTWARE_DOWNLOAD_DOORWAY
  PDF's embedded link hides a pirated-software title as a base64 blob inside the URL path/query (and/or carries the ``download|`` doorway-template marker), rather than in visible text. This is a TCPDF-generated SEO doorway that ranks for software-piracy searches and funnels users to fake 'crack/keygen' download pages distributing adware, potentially-unwanted programs, or droppers. The base64 encoding is deliberate obfuscation to evade plaintext lure rules; the PDF itself carries no parser exploit — the risk is the linked crack-download destination.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://evacdir.com/camellia/ZG93bmxvYWR8M2VOTVRKcmJ6WjhmREUyTlRRNU9Ea3hOako4ZkRJMU9UQjhmQ2hOS1NCWGIzSmtjSEpsYzNNZ1cxaE5URkpRUXlCV01pQlFSRVpk/chimigen/bartender?miconazole=myelodysplastic&THV0cm9uIEhvbWV3b3JrcyBJbGx1bWluYXRpb24gMS42MiBIT1YgZnVsbCB2ZXJzaW9uTHV=nhba.pant PDF link annotation

  • https://www.beatschermerhorn.com/?p=7104In PDF document text
  • https://obeenetworkdev.s3.amazonaws.com/upload/files/2022/06/OMIMFjXlhwglOwNbfOME_13_aab3b833c312a13f126c242ca999fda8_file.pdfIn PDF document text
  • http://www.7daystobalance.com/advert/diablo2serialkey/In PDF document text
  • https://www.29chat.com/upload/files/2022/06/UPmSoB5gMCcSgClstt5v_13_ca7a3d5c755189cda23c2543c9d00931_file.pdfIn PDF document text
  • https://supportlocalbiz.info/wp-content/uploads/2022/06/quesamp.pdfIn PDF document text
  • http://outsourcebookkeepingindia.com/wp-content/uploads/2022/06/Steinberg_LM4_Mark_II_VSTi_V11_cubase_Drumkit_From_Hell_Free.pdfIn PDF document text
  • https://learnpace.com/europa-universalis-iv-wealth-of-nations-collection-crack-dll/In PDF document text
  • https://www.5etwal.com/cx-programmer-9-3-download/In PDF document text
  • https://www.hoursmap.com/wp-content/uploads/2022/06/BlueStacks_460_Crack.pdfIn PDF document text
  • http://buquad.com/wp-content/uploads/2022/06/Activate_B2_Teachers_Book_Download.pdfIn PDF document text
  • https://acheinoaraguaia.com/wp-content/uploads/2022/06/SCS_Unlocker_For_Locked_Mods__Euro_Truck_Simulator_2_BEST.pdfIn PDF document text
  • https://djolof-assurance.com/?p=16131In PDF document text
  • http://www.clyouththeatre.org/?p=10003In PDF document text
  • https://cgservicesrl.it/wp-content/uploads/2022/06/Pack_Imagenes_Hentai_Rin_Kagamine.pdfIn PDF document text
  • https://lombard-magnet.ru/2022/06/13/coreldraw-x6-sp4-iso-setup-free-install/In PDF document text
  • https://conbluetooth.net/wow-3-3-5-addons-npc-scan-overlay/In PDF document text
  • https://cloudinfo.guru/wp-content/uploads/2022/06/Ebook_Atraccion_Hipnotica_PDF.pdfIn PDF document text
  • https://citywharf.cn/download-fiela-se-kind-movie-free-best/In PDF document text
  • https://obeenetworkdev.s3.amazonaws.com/upload/files/2022/06/R8vwVLmOapv3Q5Xc62TN_13_9130c9cfc5cbf361599b4cee722809aa_file.pdfIn PDF document text
  • https://oursocial.io/upload/files/2022/06/Jzd5bQyjBMmLMpcJEaeh_13_ca7a3d5c755189cda23c2543c9d00931_file.pdfIn PDF document text
  • http://evacdir.com/camellia/zg93bmxvywr8m2votvrkcmj6wjhmreuytlrrnu9ea3hoako4zkrjmu9uqjhmq2hos1ncwgizsmtjsepsyznnz1cxae5urkpruxlcv01pqlfsrvpk/chimigen/bartender?miconazole=myelodysplastic&thv0cm9uiehvbwv3b3jrcybjbgx1bwluyxrpb24gms42mibit1ygznvsbcb2zxjzaw9uthv=nhba.pantIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.