Malicious PDF — malware analysis report

Heuristics 6

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• ClamAV scan did not complete info CLAMAV_SCAN_INCOMPLETE
  ClamAV scan on this file did not complete (ClamAV error (exit 2)); the verdict reflects only static heuristics. The result is not cached so a later submission will retry the scan.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ponafet.ru/award?keyword=arabic+alphabet+with+words+and+pictures+pdf

  • https://cdn-cms.f-static.net/uploads/4494417/normal_601f5b886d28f.pdf
  • https://static.s123-cdn-static.com/uploads/4452609/normal_5fed344036746.pdf
  • https://cdn-cms.f-static.net/uploads/4369173/normal_601010b3cb6e2.pdf
  • https://cdn-cms.f-static.net/uploads/4402721/normal_5fda7532e989a.pdf
  • https://cdn-cms.f-static.net/uploads/4425211/normal_60128470bf7f5.pdf
  • https://cdn-cms.f-static.net/uploads/4493597/normal_5fe7bef73033f.pdf
  • https://bojibelatos.weebly.com/uploads/1/3/4/0/134040608/jijubenedo-zamil-wusojifofu-fafosukoloro.pdf
  • https://cdn-cms.f-static.net/uploads/4381971/normal_5fdba5c4528d1.pdf
  • https://cdn-cms.f-static.net/uploads/4454971/normal_601a296e718ed.pdf
  • https://cdn-cms.f-static.net/uploads/4386333/normal_5fd814db898df.pdf
  • https://komomofuxuz.weebly.com/uploads/1/3/4/4/134494735/b7e443961d108ae.pdf
  • http://www.ascendercorp.com/
  • http://www.ascendercorp.com/typedesigners.html
  • https://s3.amazonaws.com/lodazojamuva/numunoparawuxowuraxakowi.pdf
  • https://s3.amazonaws.com/dixaleko/topewogaxesaviginetivi.pdf
  • https://d52aed46-be45-4f9b-8106-cf6fc7ee66c0.filesusr.com/ugd/b148e5_ae460364d92b43e5ac60f3d15ed74acc.pdf?index=true
  • http://kiduvunizujenav.rf.gd/pdf_to_midi_converter_free.pdf
  • https://s3.amazonaws.com/sinadi/analogia_entis_erich_przywara.pdf
  • http://gasanilu.epizy.com/52895045102.pdf
  • https://e691ad07-92dc-45fa-af10-8929b4045ede.filesusr.com/ugd/87b9a8_59d20b61bcff46288a0e91d98303962d.pdf?index=true
  • https://49b821e7-ee7e-41b4-809b-d0417b8c1ddf.filesusr.com/ugd/927743_46d7f82fff6845519b45acf0f715eb58.pdf?index=true
  • https://b3a1a1c9-4f8f-4fb8-b7cc-7339030cc889.filesusr.com/ugd/162fe6_252df34acbb04916a7763fcecb8df750.pdf?index=true
  • https://s3.amazonaws.com/nijosinizo/ritemafunusifikepezep.pdf
  • https://s3.amazonaws.com/setikizo/gufevej.pdf
  • http://zaberosem.rf.gd/tozaji.pdf
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • http://purl.org/dc/elements/1.1/
  • http://ns.adobe.com/pdf/1.3/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/rights/
  • http://scripts.sil.org/OFL

Open this report in the interactive analyzer, or submit your own file for analysis.