Malicious PDF — malware analysis report

Heuristics 5

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://midufefew.ru/aws?utm_term=night+owl+dvr+ddns+configuration

  • http://roskycnmx.com/zarchiver_donate_apk_latest_versiongzjdn.pdf
  • http://redit.fun/crock-pot_smart-pot_4-quart_digital_slow_cooker_white_sccpvp400vh2j5.pdf
  • http://rostov-mobile-doctor.ru/16341451299f3sji.pdf
  • http://www.ascendercorp.com/
  • http://www.ascendercorp.com/typedesigners.html
  • http://www.daltonmaag.com/
  • https://s3.amazonaws.com/zagubip/informant_meaning_in_urdu.pdf
  • https://s3.amazonaws.com/rudelazifizuvo/48378340839.pdf
  • https://s3.amazonaws.com/lowebemuwojiso/wurenarusarirememukikes.pdf
  • https://s3.amazonaws.com/nokiva/canzoniere_per_bambini_chitarra.pdf
  • http://jelenexej.rf.gd/b36tc_bonanza_turboprop_performance_specs.pdf
  • https://s3.amazonaws.com/daselex/6011169835.pdf
  • http://subuvitoruxev.rf.gd/pdf_to_word_converter_for_macbook_pro.pdf
  • http://runugerobel.rf.gd/13941362923.pdf
  • https://s3.amazonaws.com/viromibukoleliw/bombay_dyeing_cotton_bed_sheet_amazon.pdf
  • http://koxowasone.epizy.com/mibonodez.pdf
  • http://zolivowubek.epizy.com/xuwebapikux.pdf
  • http://japefafe.epizy.com/filegeretoxuwi.pdf
  • https://s3.amazonaws.com/dogazisuze/apex_legends_macbook.pdf
  • https://627ea4a7-3f28-4bf3-8c99-6a9da7dacf48.filesusr.com/ugd/1970e2_87321e0e91514f01b97b27029d0a45df.pdf?index=true
  • https://f6ce3cfb-f922-470c-9e0e-eaf724001b0e.filesusr.com/ugd/defcb2_6d186e5e0b0b40adb78bbf0e9d738011.pdf?index=true
  • https://s3.amazonaws.com/rerinago/25276193628.pdf
  • https://329f26c8-0235-4118-8622-173d264d9cf1.filesusr.com/ugd/221f3a_47c5e557ccde469db9d1e95a6d185dd9.pdf?index=true
  • http://xafaxeko.epizy.com/airtel_hd_video.pdf
  • https://s3.amazonaws.com/xazarujokemus/hotel_del_luna_ost_part_1.pdf
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • http://purl.org/dc/elements/1.1/
  • http://ns.adobe.com/pdf/1.3/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/rights/
  • http://scripts.sil.org/OFL

Open this report in the interactive analyzer, or submit your own file for analysis.