Malicious PDF — malware analysis report

Heuristics 6

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Brand-impersonation credential phishing lure critical SE_BRAND_CREDENTIAL_PHISH
  Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: action link to abused redirector https://zolegezuboz.weebly.com/uploads/1/3/4/4/134462972/6782299.pdf.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://xeltuve.com/c3?utm_term=turn+off+autocorrect+samsung+s5 PDF link annotation

  • http://quocteanviet.com/img-chamthi/files/75118750941.pdfIn PDF document text
  • https://zolegezuboz.weebly.com/uploads/1/3/4/4/134462972/6782299.pdfIn PDF document text
  • http://philipp-haberland.de/images/upload/file/80809054958.pdfIn PDF document text
  • http://grupafurman.pl/!mag2011/userfiles/file/1823448095.pdfIn PDF document text
  • http://vytvarnyobchod.cz/UserFiles/File/laxubinugu.pdfIn PDF document text
  • http://kirks-pool.com/wp-content/plugins/formcraft/file-upload/server/content/files/162a2483d9e810---buxukuletumujebowokobage.pdfIn PDF document text
  • https://figapizezedop.weebly.com/uploads/1/3/4/3/134364787/5427515.pdfIn PDF document text
  • https://latitidazus.weebly.com/uploads/1/3/4/0/134018806/mekaguxajevedar-vofonizaser-pidaxurugomuxur-xerugol.pdfIn PDF document text
  • https://cmr.qnzar.com/files/tedugukir.pdfIn PDF document text
  • https://voliguxuzewiwa.weebly.com/uploads/1/3/4/7/134762967/45efd5eb5efe22.pdfIn PDF document text
  • https://nadegogu.weebly.com/uploads/1/4/2/3/142333281/3292347.pdfIn PDF document text
  • https://dizumosurekasev.weebly.com/uploads/1/4/1/2/141257587/7023870.pdfIn PDF document text
  • https://daxexamuve.weebly.com/uploads/1/3/4/4/134446800/modadilasis.pdfIn PDF document text
  • https://guwotozoxotemu.weebly.com/uploads/1/4/2/4/142439426/zupefonoxufarulezexo.pdfIn PDF document text
  • http://kaplanpm.com/wp-content/plugins/formcraft/file-upload/server/content/files/1630eec04012eb---mikazadikorisebav.pdfIn PDF document text
  • http://giorgimpianti.com/userfiles/file/mitonudi.pdfIn PDF document text
  • https://guvuzemepotusa.weebly.com/uploads/1/3/4/7/134706469/wivikojozotal.pdfIn PDF document text
  • http://sz-nuoyi.com/Upload/file/2022082300125765740.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62c236613d83d47fbe914acc/1656895073601/badshah_movie_video_songs_free.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62cbcc1db848172a286f4d3b/1657523229829/pokemon_blazed_glazed_cheats_codebreaker.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62c2fa1ced3f530d5d4e08c1/1656945181549/mixedugagisib.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62d8edb52900b25a044902d6/1658383798178/operaciones_con_decimales_1_eso_con_soluciones.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62c29d5aa2541834b50b4d72/1656921435252/forming_storming_norming_and_perform.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62c36bd2fbeebf438ee0f6f9/1656974290535/letra_junto_a_ti_maria.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62bfbabe6055590956fa2b6b/1656732350720/minecraft_rpg_map.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62b87bd1ac75ba003b79943c/1656257490866/4276464398.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62d8f81e0192bf290154eb46/1658386462637/livro_de_economia_em.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62d9b056d723cf0601c2dd8e/1658433622633/msi_laptop_camera_driver_windows_10.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62d04d2431fc6b31532daabb/1657818404736/bekakegivosuposavibi.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62cae635adf700300114973a/1657464374803/dedipisegipibidasozapali.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00009f69.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00009f69.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.