Malicious PDF — malware analysis report

Heuristics 4

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://davidsolano.org/uploads/1/3/1/0/131070904/131070904.html#film+walt+disney+streaming+vf PDF link annotation

  • http://starstatusbundles.com/uploads/1/3/1/3/131379029/zunuwazapapelo.pdfIn PDF document text
  • http://jimmyplease.com/uploads/1/3/0/6/130639757/difejobilo-gexewesagusik.pdfIn PDF document text
  • http://donostia-restaurant.com/uploads/1/3/0/5/130544811/4465640.pdfIn PDF document text
  • http://nimbus-realty.com/uploads/1/3/0/5/130542853/1dd319f5.pdfIn PDF document text
  • http://multistreams.com/uploads/1/3/0/5/130588347/53350a8938d2.pdfIn PDF document text
  • http://ohaivyisroel.org/uploads/1/3/1/3/131380868/7193296.pdfIn PDF document text
  • http://ifrinvestmentgroup1.com/uploads/1/3/0/8/130813079/d5afbad4f5389e3.pdfIn PDF document text
  • http://thismaycomeinhandy.com/uploads/1/3/0/6/130621115/8688804.pdfIn PDF document text
  • http://buddyruecustoms.com/uploads/1/3/0/3/130379226/zuzowu.pdfIn PDF document text
  • http://seafox-commander.com/uploads/1/3/0/5/130588433/1228497.pdfIn PDF document text
  • http://wehappyhair.com/uploads/1/3/0/7/130776183/kujasovukodujodeji.pdfIn PDF document text
  • http://arcticrelief.com/uploads/1/3/0/7/130740256/bipitegewanuvo.pdfIn PDF document text
  • http://advance-it.net/uploads/1/3/0/7/130740086/dalaxaxoreluko.pdfIn PDF document text
  • http://simakova-yulia.com/uploads/1/3/0/6/130639563/januzevetazixum_zovabutimazufu.pdfIn PDF document text
  • http://stokesed508webpage.com/uploads/1/3/0/9/130969893/2636996.pdfIn PDF document text
  • http://mn2inc.com/uploads/1/3/0/8/130874218/kesemeludapo.pdfIn PDF document text
  • http://carlicoboutique.com/uploads/1/3/0/8/130874232/ximuxavi.pdfIn PDF document text
  • http://sitescanada.ca/uploads/1/3/0/6/130604433/guzut.pdfIn PDF document text
  • http://goshenyoutharts.com/uploads/1/3/0/9/130969965/6b867880053c73f.pdfIn PDF document text
  • http://titanedtalk.com/uploads/1/3/0/5/130542908/8426571.pdfIn PDF document text
  • http://gregjiel.com/uploads/1/3/0/6/130639343/demibimomojafixixet.pdfIn PDF document text
  • http://beautifulislife.com/uploads/1/3/0/6/130620798/bc19fd03bb0b668.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • https://savannah.gnu.org/projects/freefont/In PDF document text
  • http://www.gnu.org/licenses/In PDF document text
  • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.