Malicious PDF — malware analysis report

Heuristics 7

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF links to a cracked-software download doorway (base64-obfuscated) high PDF_CRACKED_SOFTWARE_DOWNLOAD_DOORWAY
  PDF's embedded link hides a pirated-software title as a base64 blob inside the URL path/query (and/or carries the ``download|`` doorway-template marker), rather than in visible text. This is a TCPDF-generated SEO doorway that ranks for software-piracy searches and funnels users to fake 'crack/keygen' download pages distributing adware, potentially-unwanted programs, or droppers. The base64 encoding is deliberate obfuscation to evade plaintext lure rules; the PDF itself carries no parser exploit — the risk is the linked crack-download destination.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://findinform.com/SGVybyBhbmQgRGF1Z2h0ZXIgVG9ycmVudCBEb3dubG9hZCBbQXRpdmFkb3JdSGV/granier/multitasking/hester/item=/ZG93bmxvYWR8N0g2YTJkeWIzeDhNVFkxT0RJeE9EazROWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA.baggage PDF link annotation

  • https://azecm.ru/wp-content/uploads/2022/07/skanda_purana_sanskrit_pdf_12.pdfIn PDF document text
  • https://rehabcart.com/wp-content/uploads/2022/07/shodomy.pdfIn PDF document text
  • http://shaeasyaccounting.com/georgij-nazarov-knjige-download-pdf-2021/In PDF document text
  • http://www.hacibektasdernegi.com/wp-content/uploads/Serato_DJ_V111_With_Crack_EXCLUSIVE.pdfIn PDF document text
  • https://www.tnrhcp.com/gta-licence-key/In PDF document text
  • https://blacklistedhomeowners.com/wp-content/uploads/2022/07/SolidWorks_2010_SP00_32BIT__By_SolidSQUAD_27.pdfIn PDF document text
  • https://www.petsforever.io/wp-content/uploads/2022/07/measadd.pdfIn PDF document text
  • https://tgmcn.com/eztitles-plugin-for-adobe-premiere-extra-quality-crack-torrent/In PDF document text
  • http://dottoriitaliani.it/ultime-notizie/senza-categoria/netdvrv3download-exclusive/In PDF document text
  • https://bmanadvocacy.org/wp-content/uploads/2022/07/benbro.pdfIn PDF document text
  • http://freemall.jp/easyusetools-to-activate-tomtom-maps-till-8-25-with-6-7-8-soft-serial-key-keygen-updated.htmlIn PDF document text
  • https://www.52zhongchou.com/wp-content/uploads/2022/07/Estadistica_Para_Negocios_Y_Economia_12_Edicion_Pdf_145_LINK.pdfIn PDF document text
  • https://cleverfashionmedia.com/advert/the-hitman-s-bodyguard-english-tamil-dubbed-watch-online/In PDF document text
  • https://www.acvconsultoria.com/wp-content/uploads/2022/07/registration_code_sonar_8_cwwt800867845067359-1.pdfIn PDF document text
  • https://www.pianosix.com/adventures-of-tintin-the-secret-of-the-unicorn-serial-number-top/In PDF document text
  • https://centralpurchasing.online/chrysler-navtec-05064033ai-inmotion-2-15-32-iso-verified/In PDF document text
  • https://wakandaplace.com/wp-content/uploads/2022/07/SprintLayout60TorrentDownload_HOT.pdfIn PDF document text
  • https://ksycomputer.com/bounce-classic-240x320-resolution-updated/In PDF document text
  • https://turn-key.consulting/2022/07/25/download-movie-english-audio-track-best/In PDF document text
  • https://blacklistedhomeowners.com/wp-In PDF document text
  • http://freemall.jp/easyusetools-to-activate-tomtom-maps-till-8-25-with-6-7-8-soft-serial-key-keygen-In PDF document text
  • https://www.52zhongchou.com/wp-In PDF document text
  • https://www.acvconsultoria.com/wp-In PDF document text
  • http://findinform.com/sgvybybhbmqgrgf1z2h0zxigvg9ycmvudcbeb3dubg9hzcbbqxrpdmfkb3jdsgv/granier/multitasking/hester/item=/zg93bmxvywr8n0g2ytjkewizedhnvfkxt0rjee9eazrowhg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda.baggageIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.