Malicious PDF — malware analysis report

Heuristics 5

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
  PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
• PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
  PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://find24hs.com/ZG93bmxvYWR8Znc1TjNveGNueDhNVFkyT1RReE5qUXlPWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/boneheaded=josip?cmV2aXNlZCBtYXN0ZXJtaW5kIHVzZSBvZiBlbmdsaXNoIHRlYWNoZXIncyBib29rIGZyZWUgZG93bmxvYWQcmV=rufino&alcs=itis PDF link annotation

  • https://karydesigns.com/wp-content/uploads/2022/11/wylapp.pdfIn PDF document text
  • http://www.cpakamal.com/74051-2/In PDF document text
  • https://medicilearningit.com/fineprint-7-10-keygen-__top__-for-19/In PDF document text
  • https://py4tw2.infiniteuploads.cloud/2022/11/hitman_absolution_v_104331_trainer.pdfIn PDF document text
  • https://arlingtonliquorpackagestore.com/wp-content/uploads/2022/11/CRACK_UltraISO_Premium_Edition_v9332685_Seriallatest__kk_.pdfIn PDF document text
  • https://www.mjeeb.com/wp-content/uploads/2022/11/Google_G_Wizard_G_Code_Editor_And_Simulator_Cracked.pdfIn PDF document text
  • https://1w74.com/crack-toneboosters-all-plugins-bundle-v3-0-5-win-macosx-incl-keygen-r-link/In PDF document text
  • https://dsdp.site/it/?p=89016In PDF document text
  • https://www.thebangladeshikitchen.com/wp-content/uploads/2022/11/harlmika.pdfIn PDF document text
  • http://masterarena-league.com/wp-content/uploads/2022/11/kaeonil.pdfIn PDF document text
  • http://find24hs.com/zg93bmxvywr8znc1tjnvegnuedhnvfkyt1rree5quxlpwhg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda/boneheaded=josip?cmv2axnlzcbtyxn0zxjtaw5kihvzzsbvziblbmdsaxnoihrlywnozxincybib29rigzyzwugzg93bmxvywqcmv=rufino&alcs=itisIn PDF document text
  • http://www.tcpdf.orgIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://www.aiim.org/pdfa/ns/extension/In PDF document text
  • http://www.aiim.org/pdfa/ns/schema#In PDF document text
  • http://www.aiim.org/pdfa/ns/property#In PDF document text
  • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.