Malicious PDF — malware analysis report

Heuristics 4

• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://pelibifir.ru/strik?utm_term=fluke+microscanner2+cable+verifier+%25E0%25B9%2580%25E0%25B8%2584%25E0%25B8%25A3%25E0%25B8%25B7%25E0%25B9%2588%25E0%25B8%25AD%25E0%25B8%2587%25E0%25B8%2595%25E0%25B8%25A3%25E0%25B8%25A7%25E0%25B8%2588+%25E0%25B8%25AA%25E0%25B8%25AD%25E0%25B8%259A+%25E0%25B8%25AA%25E0%25B8%25B2%25E0%25B8%25A2%25E0%25B9%2580%25E0%25B8%2584%25E0%25B9%2580%25E0%25B8%259A%25E0%25B8%25B4%25E0%25B9%2589%25E0%25B8%25A5 PDF link annotation

  • http://vopibuxipem.22web.org/cheadle_and_marple_sixth_form_college_ofsted.pdfIn PDF document text
  • http://warajuvevuv.medianewsonline.com/36164583948.pdfIn PDF document text
  • http://verenica.net/artificial_intelligence_companies_in_americau0n3j.pdfIn PDF document text
  • http://gibelineg.sportsontheweb.net/palidafujulopi.pdfIn PDF document text
  • http://life-news.tech/462933359034l8ql.pdfIn PDF document text
  • http://detozube.scienceontheweb.net/49787695130.pdfIn PDF document text
  • http://wemufonenirivor.22web.org/32511133720.pdfIn PDF document text
  • http://niburufajanuto.sportsontheweb.net/pominininuv.pdfIn PDF document text
  • http://www.opentle.orgIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://nutimuratibuzur.epizy.com/19836836555.pdfIn PDF document text
  • https://4c2674ec-1430-4cec-a455-d6a35d10586e.filesusr.com/ugd/38955b_4065a2c946164ffcbcb64f4f0196a659.pdf?index=trueIn PDF document text
  • http://ribagapiwog.epizy.com/autocad_free_download_for_windows_7_32_bit_filehippo.pdfIn PDF document text
  • https://dc6b22d1-fd3c-476a-b8f1-b0505981f591.filesusr.com/ugd/ab5adf_a867ae27bfa1445abe60f6d9303fd600.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/xuzed/best_r_programming_books_for_beginners.pdfIn PDF document text
  • https://s3.amazonaws.com/kulinisokakewi/google_arcore_android_6.pdfIn PDF document text
  • https://d8d691c7-cf48-432b-bece-a54604b57851.filesusr.com/ugd/1e3a4b_94fec6bca4d8477ea7158752a8ed3e36.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/nosepevozux/background_music_free.pdfIn PDF document text
  • http://tatoguninorevem.epizy.com/cas_model_lp_1000_manual.pdfIn PDF document text
  • http://zoloraliri.epizy.com/wenadugokugavogika.pdfIn PDF document text
  • https://18aefb47-0221-41c7-ace0-4f78eb33e730.filesusr.com/ugd/bca722_e988a66012a24946bddb49d78b9f61d1.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.