Malicious PDF — malware analysis report

Heuristics 5

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
  Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://mapleshirefarms.com/uploads/1/3/1/4/131437312/131437312.html#baba+yetu+angel+city+chorale+pdf PDF link annotation

  • http://write-order.com/uploads/1/3/1/3/131398515/d6431250e.pdfIn PDF document text
  • http://tavagliones.com/uploads/1/3/1/3/131380741/2792550.pdfIn PDF document text
  • http://bluewingstudio.com/uploads/1/3/0/5/130542852/d2d3153c1d6a.pdfIn PDF document text
  • http://dfwtreecare.net/uploads/1/3/1/4/131413362/bodanozisadagoz.pdfIn PDF document text
  • http://music-school.com/uploads/1/3/0/2/130272552/6506471.pdfIn PDF document text
  • http://cheyennecoffeeco.com/uploads/1/3/0/4/130483564/3183539.pdfIn PDF document text
  • http://kindredphr.io/uploads/1/3/0/2/130291646/jujikeza.pdfIn PDF document text
  • http://nournournour.com/uploads/1/3/0/4/130476539/9056139.pdfIn PDF document text
  • http://cameliascandles.com/uploads/1/3/0/4/130483632/2015656.pdfIn PDF document text
  • http://fads4dads.com/uploads/1/3/1/3/131381602/481af.pdfIn PDF document text
  • http://mynutritionar.com/uploads/1/3/1/3/131379236/5635018.pdfIn PDF document text
  • http://camelotbrittanys.com/uploads/1/3/0/4/130493968/tiwebaxikulufumoj.pdfIn PDF document text
  • http://kirkplayers.com/uploads/1/3/0/4/130488974/xurimuzufonivuluv.pdfIn PDF document text
  • http://scrunchienation.com/uploads/1/3/1/4/131407807/genenojajifeguz.pdfIn PDF document text
  • https://musescore.040000000000000000832667268468867405317723751068115234375In PDF document text
  • https://nocdn.com/static/musescore/scoredata/gen/6/7/8/1443876/ecf69ba9b174325c8cea4076bdcc9281f06db566/score_0In PDF document text
  • https://musescore.item-list:last-childIn PDF document text
  • https://musescoreIn PDF document text
  • https://musescore.1In PDF document text
  • https://musescore.01000000000000000020816681711721685132943093776702880859375},{In PDF document text
  • https://musescore.[5In PDF document text
  • https://musescore.1000000000000000055511151231257827021181583404541015625},{In PDF document text
  • https://musescore.png@180x252In PDF document text
  • https://musescore.thefreelibrary.mid?revision=1495087261In PDF document text
  • http://www.-a0138447585In PDF document text
  • https://musescore.netIn PDF document text
  • https://musescore.png@300x420?no-cache=1579255647&bgclr=ffffffIn PDF document text
  • https://musescore.com\rTheIn PDF document text
  • https://musescore.mp3?revision=1495087261&no-cache=1587719097In PDF document text
  • https://musescore.1000000000000000055511151231257827021181583404541015625In PDF document text
  • https://musescore...com/score/stats/viewIn PDF document text
  • http://angelcitychorale.com/user/3435351/scores/1443876In PDF document text
  • https://soundcloud.200000000000000011102230246251565404236316680908203125},{In PDF document text
  • http://www.com/static/musescore/scoredata/gen/6/7/8/1443876/ecf69ba9b174325c8cea4076bdcc9281f06db566/score_0In PDF document text
  • https://musescore.com/The+American+Tenors+Make+Their+Recording+Debut+on+Sony+Classical%3B+CD.0200000000000000004163336342344337026588618755340576171875In PDF document text
  • https://musescore.com/user/3435351In PDF document text
  • https://musescore.com/angelcitychoraleIn PDF document text
  • https://musescore.openx.thefreelibrary.com/watch?v=L-In PDF document text
  • http://www.com/user/3435351/scores/1443876In PDF document text
  • https://musescore.com/Mary+Chapin+Carpenter+Set+to+Perform+at+the+Democratic+NationalIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.