Malicious PDF — malware analysis report

Heuristics 4

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://bpmusiceditions.com/uploads/1/3/0/4/130475881/130475881.html#university+of+chicago+classics+department PDF link annotation

  • http://www.mickeyandminis.net/uploads/1/3/0/6/130640088/4807264.pdfIn PDF document text
  • http://xn--mnnerdit-0zag.com/uploads/1/3/0/6/130639521/dekapofigu.pdfIn PDF document text
  • http://empoweringcitizens.org/uploads/1/3/0/2/130287934/566f29dc925846b.pdfIn PDF document text
  • http://here2organize.com/uploads/1/3/1/1/131164573/8749610.pdfIn PDF document text
  • http://primeclassutah.com/uploads/1/3/0/2/130272606/499cbb2.pdfIn PDF document text
  • http://ctbfresh.com/uploads/1/3/0/2/130273623/xalefuwojaledud_jolomaserebove.pdfIn PDF document text
  • http://photography-classes-tours.com/uploads/1/3/1/0/131070071/rusevadukasiti.pdfIn PDF document text
  • http://www.starsandimagination.com/uploads/1/3/0/3/130313108/likedorikuvisa_fuburogixibazu_watidigaxunovo.pdfIn PDF document text
  • http://dualtutors.com/uploads/1/3/0/8/130873995/pakudazo.pdfIn PDF document text
  • http://www.ozeron.com/uploads/1/3/0/4/130479472/waseselefinusetesudu.pdfIn PDF document text
  • http://cpanel.indigoeventservices.com/uploads/1/3/0/5/130541803/laxakefe.pdfIn PDF document text
  • http://balonprocess.com/uploads/1/3/0/6/130622106/kekibuzuwo.pdfIn PDF document text
  • http://hostmaster.bathgatewayoutandabout.co.uk/uploads/1/3/0/5/130539329/663789.pdfIn PDF document text
  • http://stormbroker.net/uploads/1/3/0/4/130476984/dipujaz.pdfIn PDF document text
  • http://mail.synchealthfit.net/uploads/1/3/0/5/130589252/mesodep.pdfIn PDF document text
  • http://www.myentouragemusic.com/uploads/1/3/0/6/130605462/zopisukosowaf.pdfIn PDF document text
  • http://epcfootball.com/uploads/1/3/0/3/130323620/subukavu.pdfIn PDF document text
  • http://poseidonpowerkft.com/uploads/1/3/0/6/130605476/jebumivokazi.pdfIn PDF document text
  • http://hostmaster.mackplumbing.com/uploads/1/3/0/2/130289573/fikofuxivupe.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.