Malicious PDF — malware analysis report

Heuristics 4

• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://maypoin.ru/strik?utm_term=g+shock+tough+solar+won%2527t+charge PDF link annotation

  • http://uorott.com/deixis_exercises_with_answersrency.pdfIn PDF document text
  • http://pedron.fun/7273393744lpyj.pdfIn PDF document text
  • http://bejonigu.22web.org/anatomy_and_physiology_of_small_intestine.pdfIn PDF document text
  • http://fakafegixir.iblogger.org/gerard_butler_movie.pdfIn PDF document text
  • http://greatholl.com/work_energy_and_power_review_package962sm.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://cf075d60-af7c-4c71-a16c-5c8c125a9bb7.filesusr.com/ugd/cc03df_01cf9de1361047078db3e2978f19fd8d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/91854226-42c7-41d4-a792-dd579d559e8c/28294065588.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d6e33c4d-b453-4169-bbf0-f4b022f8bfc6/29648132144.pdfIn PDF document text
  • http://lazasubesuwup.epizy.com/29634117262.pdfIn PDF document text
  • http://gabazozota.epizy.com/why_is_planning_important_in_early_years.pdfIn PDF document text
  • http://tuguwobafadurot.rf.gd/dububokubexoru.pdfIn PDF document text
  • http://dakofuvijazeti.rf.gd/68881321009.pdfIn PDF document text
  • http://puxalalofevan.rf.gd/16661731734.pdfIn PDF document text
  • https://04c6d2be-b5ec-470f-8655-bdc68d6defec.filesusr.com/ugd/3bcfef_fd42cb60ed5d4991899096550845570b.pdf?index=trueIn PDF document text
  • http://mutunibe.rf.gd/sneakerdog_s_phases_of_mitosis_worksheet.pdfIn PDF document text
  • http://dinixebun.epizy.com/free_order_of_operations_worksheets_with_answers.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f193c6c2-d001-4d2a-9e3c-763cc2bca8bc/how_many_red_aces_are_in_a_deck_of_cards.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.