Malicious PDF — malware analysis report

Heuristics 7

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
  PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://esecuritys.com/bruner/ZG93bmxvYWR8Nml2TVdoNWRqaDhmREUyTmpJMk9EQXpPVEI4ZkRJMU9UQjhmQ2hOS1NCWGIzSmtjSEpsYzNNZ1cxaE5URkpRUXlCV01pQlFSRVpk/refracts/ermine.dented.TGEgSGlzdG9yaWEgU2VjcmV0YSBEZWwgTXVuZG8gSm9uYXRoYW4gQmxhY2sgUGRmTGE/doucet/gascoigne/ PDF link annotation

  • https://www.beaches-lakesides.com/realestate/adobe-acrobat-x-pro-10-1-3-english-french-german-keygen-core-serial-key-keygen-work/In PDF document text
  • https://stayconnectedcommunications.com/wp-content/uploads/2022/09/Il_Volo_The_Platinum_Collection_2015_MP3.pdfIn PDF document text
  • http://www.shopinrockdale.com/wp-content/uploads/2022/09/strabert.pdfIn PDF document text
  • https://omidsoltani.ir/299567/statistics-for-business-and-economics-11th-edition-solutions-manual-pdf-new-free.htmlIn PDF document text
  • https://aaddisondrivingschool.com/inpixio-photo-clip-professional-9-free-download-patchedIn PDF document text
  • https://www.dominionphone.com/making-common-sense-common-practice-third-edition-models-for-manufacturing-excellence-ron-moore-epub/In PDF document text
  • https://goandwork.net/wp-content/uploads/2022/09/aleegrai.pdfIn PDF document text
  • https://amedirectory.com/wp-content/uploads/2022/09/RobotSoftMouseandKeyboardRecorderv3192InclKeygenandP_rar_UPDATED.pdfIn PDF document text
  • https://www.iltossicoindipendente.it/2022/09/13/hd-online-player-debut-video-capture-software-pro-1-7/In PDF document text
  • https://aliffer.com/wp-content/uploads/2022/09/D3dx9_45dll_Download.pdfIn PDF document text
  • https://amtothepm.com/wp-content/uploads/2022/09/blesnann.pdfIn PDF document text
  • https://fotofables.com/r2b-return-to-base-movie-2012-torrent-kickass-download-updated/In PDF document text
  • http://gurureviewclub.com/?p=16832In PDF document text
  • https://unsk186.ru/addictive-drums-authorization-code-1-0-0-128314/In PDF document text
  • https://yourtripboy.com/wp-content/uploads/2022/09/Gli_Animali_Fantastici_Dove_Trovarli_Epub_PATCHED_Download.pdfIn PDF document text
  • https://tvlms.com/wp-content/uploads/2022/09/windows_8_pro_build_9200_iso_download.pdfIn PDF document text
  • https://thehomeofheroes.org/programmenghilangkansensorpadavideo/In PDF document text
  • https://conceptlabcreative.com/black-and-white-2-secret-creature-unlocker-tiger-game-hackIn PDF document text
  • https://thecryptobee.com/wp-content/uploads/2022/09/Adobe_Photoshop_Cs6_Free_BETTER_Download_Windows_81l.pdfIn PDF document text
  • https://abckidsclub.pl/dosprn-1-82-better-crack-12/In PDF document text
  • https://www.beaches-lakesides.com/realestate/adobe-acrobat-x-pro-10-1-3-english-french-german-In PDF document text
  • https://stayconnectedcommunications.com/wp-In PDF document text
  • https://omidsoltani.ir/299567/statistics-for-business-and-economics-11th-edition-solutions-manual-In PDF document text
  • https://www.dominionphone.com/making-common-sense-common-practice-third-edition-models-for-In PDF document text
  • https://amedirectory.com/wp-content/uploads/2022/09/RobotSoftMouseandKeyboardRecorderv3192IIn PDF document text
  • https://www.iltossicoindipendente.it/2022/09/13/hd-online-player-debut-video-capture-software-In PDF document text
  • https://yourtripboy.com/wp-In PDF document text
  • https://thecryptobee.com/wp-In PDF document text
  • http://esecuritys.com/bruner/zg93bmxvywr8nml2tvdonwrqadhmreuytmpjmk9eqxppvei4zkrjmu9uqjhmq2hos1ncwgizsmtjsepsyznnz1cxae5urkpruxlcv01pqlfsrvpk/refracts/ermine.dented.tgegsglzdg9yawegu2vjcmv0ysbezwwgtxvuzg8gsm9uyxroyw4gqmxhy2sgugrmtge/doucet/gascoigne/In PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.