Malicious PDF — malware analysis report

Heuristics 7

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• PDF links to document on public blob storage high PDF_PUBLIC_BLOB_DOCUMENT_LINK
  PDF contains a clickable action to a document payload hosted on public blob/object storage. Shared object storage can be used legitimately, so this rule is suspicious rather than conclusive unless paired with lure text or other phishing indicators.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://signforcover.com/infanthood/kindergartners/ZG93bmxvYWR8alc4TkdwcFpYeDhNVFkxTnpBek5qSXlNM3g4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/crazy/headroom/RmlmYSAyMgRml?pdic.prolific=silken PDF link annotation

  • http://dottoriitaliani.it/ultime-notizie/senza-categoria/fifa-22-mem-patch-2022-new/In PDF document text
  • https://athome.brightkidspreschool.com/blog/index.php?entryid=3912In PDF document text
  • https://wastelandconstruction.com/wp-content/uploads/2022/07/Fifa_22_Crack_File_Only___Free_Download_3264bit.pdfIn PDF document text
  • http://climabuild.com/wp-content/uploads/2022/07/carpad.pdfIn PDF document text
  • https://www.sdssocial.world/upload/files/2022/07/rxrrl9z1wmJPKWyaGMFO_05_d79f658d85d7f1118864101c22f48d96_file.pdfIn PDF document text
  • http://escortguate.com/fifa-22-2022-new/In PDF document text
  • https://pascanastudio.com/wp-content/uploads/2022/07/Fifa_22_Install_Crack___For_Windows.pdfIn PDF document text
  • https://sbrelo.com/upload/files/2022/07/XWH5Pf16KEUmWjowLNKJ_05_6689a47c0be3901e4cb6290e38810c9e_file.pdfIn PDF document text
  • https://fuckmate.de/upload/files/2022/07/F385bwJuKOb8SR5gwGKj_05_d79f658d85d7f1118864101c22f48d96_file.pdfIn PDF document text
  • https://iraqidinarforum.com/upload/files/2022/07/YEiQmLpRCKnfkwBcHLFk_05_5532dcbc322e1336c7527a23a4c02522_file.pdfIn PDF document text
  • https://storage.googleapis.com/faceorkut.com/upload/files/2022/07/t8PUL53B1A9iLajGWcWv_05_5b094424907d7b5f1911e085a5fcee75_file.pdfIn PDF document text
  • http://www.jobverliebt.de/wp-content/uploads/Fifa_22-12.pdfIn PDF document text
  • http://titanmachine.com/sites/default/files/webform/Fifa-22_16.pdfIn PDF document text
  • https://emmviron.com/wp-content/uploads/2022/07/Fifa_22_Crack__Serial_Number__Updated_2022.pdfIn PDF document text
  • https://thebakersavenue.com/fifa-22-activation-registration-code-download-april-2022/In PDF document text
  • https://www.vgccc.vic.gov.au/system/files/webform/morter861.pdfIn PDF document text
  • https://hivmemphis.org/sites/default/files/webform/statementIn PDF document text
  • https://mandarinrecruitment.com/system/files/webform/darmar489.pdfIn PDF document text
  • https://alumni.armtischool.com/upload/files/2022/07/aA6sCQYeNzYWbNjlnxJl_05_5b094424907d7b5f1911e085a5fcee75_file.pdfIn PDF document text
  • https://jakharris.africa/fifa-22-key-generator-with-license-key/In PDF document text
  • http://signforcover.com/infanthood/kindergartners/zg93bmxvywr8alc4tkdwcfpyedhnvfkxtnpbek5qsxlnm3g4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda/crazy/headroom/rmlmysaymgrml?pdic.prolific=silkenIn PDF document text
  • https://emmviron.com/wp-content/uploads/2022/07/fifa_22_crack__serial_number__updated_2022.pdfIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.