Malicious PDF — malware analysis report

Heuristics 7

• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF links to a cracked-software download doorway (base64-obfuscated) high PDF_CRACKED_SOFTWARE_DOWNLOAD_DOORWAY
  PDF's embedded link hides a pirated-software title as a base64 blob inside the URL path/query (and/or carries the ``download|`` doorway-template marker), rather than in visible text. This is a TCPDF-generated SEO doorway that ranks for software-piracy searches and funnels users to fake 'crack/keygen' download pages distributing adware, potentially-unwanted programs, or droppers. The base64 encoding is deliberate obfuscation to evade plaintext lure rules; the PDF itself carries no parser exploit — the risk is the linked crack-download destination.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• PDF advertises pirated movie streaming/download medium PDF_PIRACY_STREAMING_LURE
  PDF rendered text advertises free full-movie streaming or download using piracy-brand names or a 'full movie + download/free/watch' intent phrase — recovered after folding the styled Unicode confusables the campaign uses to hide those keywords from plain-text detection. These are disposable SEO-spam carriers that route users to malvertising, fake-player, and scam pages; the PDF itself is inert.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://evacdir.com/encircle/acquirements/U2FyZ2FtUmlzaGlLYXBvb3JGdWxsTW92aWVEb3dubG9hZAU2F/ZG93bmxvYWR8d2Q2T0RJMFlueDhNVFkxTlRNek9Ua3dOSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA?/earn.indigestions PDF link annotation

  • https://elearning.archivagroup.it/blog/index.php?entryid=3000In PDF document text
  • https://chickentowngazette.com/advert/x-force-keygen-inventor-professional-2014-keygen-__full__/In PDF document text
  • https://aula.ciapse.edu.pe/blog/index.php?entryid=20950In PDF document text
  • https://www.idhealthagency.com/health-tips/bosch-esi-tronic-v1-0-1q-2015-keygen-rar-best/In PDF document text
  • http://www.2el3byazici.com/?p=19427In PDF document text
  • http://bellarefood.com/wp-content/uploads/2022/06/CyberLink_PowerDVD_Ultra_200251064_Crack_64_bit.pdfIn PDF document text
  • https://blooder.net/upload/files/2022/06/48ZW7oWfoOgcGrEAyo4t_16_2fa8ed823f9c295f092b93e5e82ef30a_file.pdfIn PDF document text
  • http://www.theoldgeneralstorehwy27.com/wp-content/uploads/2022/06/Uploadednet_Coupon_Code_Generator.pdfIn PDF document text
  • https://psychomotorsports.com/snowmobiles/20418-inazuma-eleven-strikers-pc-game-free-download-link/In PDF document text
  • https://www.academialivet.org.mx/blog/index.php?entryid=14387In PDF document text
  • http://cyclades.in/en/?p=63813In PDF document text
  • https://wintermarathon.de/advert/gom-encoder-crack15/In PDF document text
  • https://solvefortomorrow.com/upload/files/2022/06/znrjWaheMnevJtP411ir_16_a4d6550dcb5363bc3d7ce7574f74879c_file.pdfIn PDF document text
  • https://www.callaertverzekeringen.be/nl-be/system/files/webform/visitor-uploads/latowen638.pdfIn PDF document text
  • https://teenzglobal.org/wp-content/uploads/2022/06/Chaalbaazmoviedownloaddualaudio720p.pdfIn PDF document text
  • https://anipal.es/wp-content/uploads/2022/06/Rockstar_Games_Social_Club_Download_Crack_For_16.pdfIn PDF document text
  • https://biorepo.neonscience.org/portal/checklists/checklist.php?clid=0In PDF document text
  • http://bellarefood.com/wp-content/uploads/2022/06/cyberlink_powerdvd_ultra_200251064_crack_64_bit.pdfIn PDF document text
  • http://evacdir.com/encircle/acquirements/u2fyz2ftumlzagllyxbvb3jgdwxstw92awveb3dubg9hzau2f/zg93bmxvywr8d2q2t0rjmfluedhnvfkxtlrnek9ua3doshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda?/earn.indigestionsIn PDF document text
  • https://dergsetzvidibke.wixsite.com/dramlarfirsre::dramlarfirsre:8QuuljHf4u:dergsetzvidibke@gmail.com/post/skyrim-voices-bsa-englishlIn PDF document text
  • https://borisma4whp.wixsite.com/planenliatrin/post/waaris-shah-ishq-da-waaris-movie-download-720p-hdIn PDF document text
  • https://aulasvirtuales.zaragoza.unam.mx/cv/blog/index.php?entryid=7635In PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • https://dergsetzvidibke.wixsite.com/dramlarfirsre::dramlarfirsre:8QuuljHf4u:dergsetzvidibke@gmail.com/post/skyrim-voices-bsa-In PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.