Malicious PDF — malware analysis report

Heuristics 4

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://shestylezbyjene.com/uploads/1/3/0/6/130620443/130620443.html#local+tv+guide+appleton+wi

  • http://montourridge.com/uploads/1/3/0/5/130550657/989b65da3f5aa.pdf
  • http://episcopalchurchmediator.com/uploads/1/3/0/7/130738902/3675087.pdf
  • http://alphaalienz.com/uploads/1/3/0/6/130621446/nilel_luvixuwofefo_dajefe.pdf
  • http://carcehistorynerd.org/uploads/1/3/1/4/131407281/xojigerataxexo_mimekotu_lipasukan.pdf
  • http://powerbicollege.com/uploads/1/3/1/3/131398145/c589dd17.pdf
  • http://313designs.com/uploads/1/3/1/4/131406071/zuzinina.pdf
  • http://anikah.co/uploads/1/3/0/6/130620888/zuxafezuxetew_zezulexivereti_jawerojeber.pdf
  • http://davenportishome.com/uploads/1/3/0/8/130813999/388ab88bef.pdf
  • http://euro-tres.com/uploads/1/3/0/8/130874608/pawufipagebexesine.pdf
  • http://earthdiscoverycorp.com/uploads/1/3/0/2/130271126/weref.pdf
  • http://tienichnho.net/uploads/1/3/0/2/130288510/vedepivigal_wutumerele_dedanidimu_gosunadobes.pdf
  • http://debrios.com/uploads/1/3/0/5/130551597/kivuxesukime.pdf
  • http://laurenbillingsley.com/uploads/1/3/0/6/130620968/gavume-xapoletisomaxi.pdf
  • http://ten18international.com/uploads/1/3/1/3/131383398/3581d3917.pdf
  • http://schallisflyfishing.de/uploads/1/3/0/6/130603928/5502956.pdf
  • http://nicecleanjanitorialsvc.com/uploads/1/3/0/7/130776022/besunupilogawad.pdf
  • http://santamariagestioninmobiliaria.com/uploads/1/3/0/7/130775214/jibifekogajonorigege.pdf
  • http://larueatelier.com/uploads/1/3/0/2/130271209/wefowurotinuz-sibodinib.pdf
  • http://eagleautofm.com/uploads/1/3/0/2/130287940/dexujulas-lurikematuza-sojakusaduxipub.pdf
  • http://arnhemsewijnimporteurs.nl/uploads/1/3/0/7/130739117/9963922.pdf
  • http://elementz.eu/uploads/1/3/0/4/130436122/9378319.pdf
  • http://joannturner.co/uploads/1/3/0/6/130639428/3690648.pdf
  • http://opuscs.org/uploads/1/3/0/2/130270887/kogosewojejujev_xebelajazan.pdf
  • http://silverlynxevents.com/uploads/1/3/1/4/131438641/3583084.pdf
  • http://heavenonearthhealth.com/uploads/1/3/0/7/130739853/zewasevu.pdf
  • http://www.ascendercorp.com/
  • http://www.ascendercorp.com/typedesigners.html
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • http://purl.org/dc/elements/1.1/
  • http://ns.adobe.com/pdf/1.3/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/rights/
  • http://scripts.sil.org/OFL

Open this report in the interactive analyzer, or submit your own file for analysis.