Malicious PDF — malware analysis report

Heuristics 8

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
  PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
• Viral-video clickbait PDF links to suspicious host critical SE_VIRAL_VIDEO_CLICKBAIT_LINK
  Document uses viral/leaked-video lure text and links to a suspicious disposable-looking web host. This is a clickbait/traffic-scam carrier shape rather than a benign PDF link.
• PDF links to document on public blob storage high PDF_PUBLIC_BLOB_DOCUMENT_LINK
  PDF contains a clickable action to a document payload hosted on public blob/object storage. Shared object storage can be used legitimately, so this rule is suspicious rather than conclusive unless paired with lure text or other phishing indicators.
• PDF links to a cracked-software download doorway (base64-obfuscated) high PDF_CRACKED_SOFTWARE_DOWNLOAD_DOORWAY
  PDF's embedded link hides a pirated-software title as a base64 blob inside the URL path/query (and/or carries the ``download|`` doorway-template marker), rather than in visible text. This is a TCPDF-generated SEO doorway that ranks for software-piracy searches and funnels users to fake 'crack/keygen' download pages distributing adware, potentially-unwanted programs, or droppers. The base64 encoding is deliberate obfuscation to evade plaintext lure rules; the PDF itself carries no parser exploit — the risk is the linked crack-download destination.
• PDF advertises pirated movie streaming/download medium PDF_PIRACY_STREAMING_LURE
  PDF rendered text advertises free full-movie streaming or download using piracy-brand names or a 'full movie + download/free/watch' intent phrase — recovered after folding the styled Unicode confusables the campaign uses to hide those keywords from plain-text detection. These are disposable SEO-spam carriers that route users to malvertising, fake-player, and scam pages; the PDF itself is inert.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://evacdir.com/grwoing/hiatus/joyously/ZG93bmxvYWR8SkM0TVRabFkzaDhmREUyTlRRNU9Ea3hOako4ZkRJMU56UjhmQ2hOS1NCeVpXRmtMV0pzYjJjZ1cwWmhjM1FnUjBWT1hR.hippies?ZnJlZWRvd25sb2FkQ2FrZXdhbGtTdHVkaW9JbnN0cnVtZW50c0Z1bGxWZXJzaW9uZnJ=kalp/smpte.lipid PDF link annotation

  • https://txuwuca.com/upload/files/2022/06/b5xg1a9pEMH3IPXfHiwu_13_97e249a3012cd3e90686718bf4abedbb_file.pdfIn PDF document text
  • https://mimaachat.com/upload/files/2022/06/shV1kxC3VSXLUeQoKYbH_13_52d72bcf9e8c0d44e08e8540be9579b4_file.pdfIn PDF document text
  • http://maili.demoe.cn:112/upload/files/2022/06/updbWBjw83akIni9ZyWy_13_7623315a8db524dcb3e2f4ec25d74eb0_file.pdfIn PDF document text
  • https://verrtise.com/advert/code-activation-cubase-7-keygen-top/In PDF document text
  • https://www.realteqs.com/teqsplus/upload/files/2022/06/ADrLu9SxNpXIqCDSIxww_13_52d72bcf9e8c0d44e08e8540be9579b4_file.pdfIn PDF document text
  • https://libertycentric.com/upload/files/2022/06/ywvXKEbV8Lu8hChjuCZq_11_e186ab138252e963994e5157b475c0f9_file.pdfIn PDF document text
  • https://storage.googleapis.com/faceorkut.com/upload/files/2022/06/Iq2hT1Qq3DnYvMVSmqXR_13_8cee1d8ad4683755835f4405c49604b1_file.pdfIn PDF document text
  • https://www.pedomanindonesia.com/advert/cara-hack-jadi-admin-suatu-grup-di-19/In PDF document text
  • https://www.nmmedical.fr/blog/advert/tera-font-trilochan-normal-ttf/In PDF document text
  • https://www.topperireland.com/advert/bioshock-2-key/In PDF document text
  • https://dolneoresany.fara.sk/advert/xforce-keygen-top-bim-360-design-2014-download-64-bit/In PDF document text
  • https://petersburg.com/advert/naam-shabana-full-movies-720p-download/In PDF document text
  • https://jointium.s3.amazonaws.com/upload/files/2022/06/HGcJk2K557pJQN8j2MUs_13_522a759b4cb8d0dd890c91a50fc741d0_file.pdfIn PDF document text
  • http://nerdsell.co.za/advert/fx-guru-enter-unlock-code/In PDF document text
  • https://workplace.vidcloud.io/social/upload/files/2022/06/TfVnQVOqFJxbDDkrgvbe_13_7623315a8db524dcb3e2f4ec25d74eb0_file.pdfIn PDF document text
  • https://www.spasvseyarusi.ru/advert/download-high-quality-3ds-max-2013-msi/In PDF document text
  • https://www.kekogram.com/upload/files/2022/06/LULVaYJ4X5JfBykrAkYS_13_f5ca61852e60e910df33e2b52355b529_file.pdfIn PDF document text
  • https://ex0-sys.app/upload/files/2022/06/RM5RVIOghqBadkPiIG6k_13_522a759b4cb8d0dd890c91a50fc741d0_file.pdfIn PDF document text
  • https://ebs.co.zw/advert/hannibal-flynt-thunderdome-ultimate-samplepack-wav-free/In PDF document text
  • http://evacdir.com/grwoing/hiatus/joyously/zg93bmxvywr8skm0tvrabfkzadhmreuytlrrnu9ea3hoako4zkrjmu56ujhmq2hos1ncevpxrmtmv0pzyjjjz1cwwmhjm1fnujbwt1hr.hippies?znjlzwrvd25sb2fkq2frzxdhbgttdhvkaw9jbnn0cnvtzw50c0z1bgxwzxjzaw9uznj=kalp/smpte.lipidIn PDF document text
  • https://spacezozion.nyc3.digitaloceanspaces.com/upload/files/2022/06/srJb2wp7Uk4umobz2GRN_13_522a759b4cb8d0dd890c91a50fc741d0_file.pdfIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.