Malicious PDF — malware analysis report

Heuristics 6

• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://seachtop.com/areest/brewing/claiming/YWlyaHlicmlkM2NyYWNrNAYWl/jintao.overemphasise/ZG93bmxvYWR8MmNvTkRObVpYeDhNVFkyTWpZNE1ETTVNSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA.pinprick.surfaced PDF link annotation

  • http://dichvuhoicuoi.com/iron-man-armored-adventures-season-1-torrent-fix-download/In PDF document text
  • https://www.9mesi.eu/wp-content/uploads/2022/09/Enroute_5_Cad_Camrar-1.pdfIn PDF document text
  • https://www.spasvseyarusi.ru/advert/volcano1997fullmovieinhindidownload-repack/In PDF document text
  • https://nameless-peak-18337.herokuapp.com/Wondershare_DrFone_v103023_Final_Crack_rar.pdfIn PDF document text
  • http://insenergias.org/?p=77862In PDF document text
  • https://www.faceauxdragons.com/advert/zebradesigner-pro-v1-0-2-build-553-4-zip-new/In PDF document text
  • http://www.affiliate1on1.com/wp-content/uploads/2022/09/Rational_Rose_2007_Licenceepub.pdfIn PDF document text
  • https://www.nesoddenhk.no/wp-content/uploads/2022/09/Chemal_Gegg_Alissa_Model_Sets_1_112.pdfIn PDF document text
  • http://www.camptalk.org/easyworship-2009-confirmation-id/In PDF document text
  • https://kmtu82.org/apaharan-part-1-in-hindi-dubbed-torrent-download-__link__/In PDF document text
  • https://gurureviewclub.com/wp-content/uploads/2022/09/valenadi.pdfIn PDF document text
  • https://www.15heures.com/photos/p/96242In PDF document text
  • https://topgiftsforgirls.com/hd-online-player-download-new-phas-gaye-re-obama-3-hd-720/In PDF document text
  • https://dashiofficial.com/wp-content/uploads/2022/09/nanpelh.pdfIn PDF document text
  • https://lexcliq.com/anatomia-comparata-dei-vertebrati-liem/In PDF document text
  • https://malekrealty.org/finders-ativador-__exclusive__-download/In PDF document text
  • https://sleepy-springs-30277.herokuapp.com/harrypotterazkabanifogolypdf37.pdfIn PDF document text
  • https://aqueous-brushlands-40361.herokuapp.com/Hamsphere_30_crack.pdfIn PDF document text
  • http://mrproject.com.pl/advert/landmark-advanced-teacher-book-pdf-top-free-13/In PDF document text
  • https://coutureforthebride.com/wp-content/uploads/2022/09/niqkeel.pdfIn PDF document text
  • http://seachtop.com/areest/brewing/claiming/ywlyahlicmlkm2nyywnrnaywl/jintao.overemphasise/zg93bmxvywr8mmnvtkrobvpyedhnvfkytwpzne1ettvnshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda.pinprick.surfacedIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.