Malicious PDF — malware analysis report

Heuristics 5

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jumiwimov.ru/aws?utm_term=simply+keto+website

  • http://wepijafiguwenan.mywebcommunity.org/bewise_classes_notes_gk.pdf
  • http://wasatosu.sportsontheweb.net/mupolus.pdf
  • http://ruwemipuwev.mypressonline.com/45963993775.pdf
  • http://gexomafe.mypressonline.com/4457863881.pdf
  • http://www.ascendercorp.com/
  • http://www.ascendercorp.com/typedesigners.html
  • http://www.opentle.org
  • https://s3.amazonaws.com/xeponodij/78951115392.pdf
  • http://nimanexobubibub.onlinewebshop.net/how_to_factory_restore_apple_time_capsule.pdf
  • https://s3.amazonaws.com/zopenave/325047030.pdf
  • http://kisalonokexiwi.atwebpages.com/11443629054.pdf
  • http://tenurusimuxu.epizy.com/automation_anywhere_user_manual.pdf
  • https://bff5fdab-9fd0-4670-908b-a1308bb5a9cb.filesusr.com/ugd/227d0f_013575f686d541c7a1b9756e2fd24a48.pdf?index=true
  • https://s3.amazonaws.com/firudegix/57184188222.pdf
  • http://lodakakurozakod.epizy.com/gisebarusetewumo.pdf
  • https://696f1bd8-06c3-47a7-a8f7-e83e17ec8d18.filesusr.com/ugd/5ad03d_8718d77d07d44fe18da050ebd04417b2.pdf?index=true
  • https://s3.amazonaws.com/tugafebip/sonic_nutrition_breakfast_burrito.pdf
  • http://jasunusemoki.onlinewebshop.net/vocabulary_test_with_answers_for_high_school.pdf
  • https://s3.amazonaws.com/gonafoziguwewe/einthusan_er_online.pdf
  • https://s3.amazonaws.com/pusori/bank_customer_service_representative_resume_no_experience.pdf
  • https://s3.amazonaws.com/mubefula/resident_evil_movie_in_tamil_hd.pdf
  • https://bb55feb6-a0c4-48ae-8f72-aea2c45912f8.filesusr.com/ugd/b9801a_6b0175055175443b8a090afc7c9f9760.pdf?index=true
  • https://s3.amazonaws.com/vatakefojunib/callus_formation_after_rib_fracture.pdf
  • http://kenamumiv.rf.gd/farberware_pressure_cooker_guide.pdf
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • http://purl.org/dc/elements/1.1/
  • http://ns.adobe.com/pdf/1.3/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/rights/
  • http://scripts.sil.org/OFL
  • http://www.gnu.org/licenses/gpl.html

Open this report in the interactive analyzer, or submit your own file for analysis.