Malicious PDF — malware analysis report

Heuristics 5

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• ClamAV scan did not complete info CLAMAV_SCAN_INCOMPLETE
  ClamAV scan on this file did not complete (ClamAV error (exit 2)); the verdict reflects only static heuristics. The result is not cached so a later submission will retry the scan.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://mezovuduw.ru/wix?keyword=freshwater+biome+animals+and+their+adaptations

  • https://dejutuzalusabi.weebly.com/uploads/1/3/4/8/134869317/b8a63.pdf
  • https://jazelisis.weebly.com/uploads/1/3/4/8/134870131/1220757.pdf
  • https://bizowubojixix.weebly.com/uploads/1/3/4/2/134265373/2567372.pdf
  • https://cdn-cms.f-static.net/uploads/4495402/normal_60586365134f8.pdf
  • https://nafipitomaw.weebly.com/uploads/1/3/5/3/135349771/pumepomakemitaxuw.pdf
  • https://zabugejagovim.weebly.com/uploads/1/3/1/6/131637755/8529925.pdf
  • http://newipufisatag.scienceontheweb.net/witanuz.pdf
  • http://ziximotizaned.medianewsonline.com/39053443439.pdf
  • http://koxivesuvif.mypressonline.com/aprender_a_tocar_guitarra_electrica_muy_completo.pdf
  • https://cdn-cms.f-static.net/uploads/4376856/normal_60390689b952c.pdf
  • https://cdn-cms.f-static.net/uploads/4470689/normal_604f55ba91327.pdf
  • https://50aad03f-9d2a-47e6-be13-abd12f321b17.filesusr.com/ugd/3fd638_9df9c68fe8cb4a8584acd2eb1d59aee0.pdf?index=true
  • https://9db8f275-5044-409a-aa1b-3306d9dda9bd.filesusr.com/ugd/361f4b_d1652b0f434c4301ba1996c321f08cda.pdf?index=true
  • http://fojosotum.myartsonline.com/how_to_download_codecs.pdf
  • http://jelunegizubu.atwebpages.com/rancilio_silvia_model_e.pdf
  • http://rabatelekovufar.myartsonline.com/21076496224.pdf
  • https://b1b1ed1d-a631-407f-b8a0-2f609481a9c2.filesusr.com/ugd/3e5895_870d949c206e4509b4b52396bda66494.pdf?index=true
  • https://737bf953-b780-43bc-8af0-312ed5328a40.filesusr.com/ugd/017c44_0812a83ab519423193b562da11896953.pdf?index=true
  • http://gujimosodaza.myartsonline.com/sinixopozorada.pdf
  • https://507d1b22-ea03-4061-a262-f79425337ca2.filesusr.com/ugd/a374b9_f20adc61ba4a4b89bb6b84fb362f9f74.pdf?index=true
  • https://c931c956-7f53-4e4e-96dc-27d7f003ba63.filesusr.com/ugd/b80c10_0488a2c4282b4ed3abd4a2ee57e45d6a.pdf?index=true
  • https://77483064-5892-4b52-b419-66e751946b77.filesusr.com/ugd/ef7b09_6fde8321257148048429678bc64fe643.pdf?index=true
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • http://purl.org/dc/elements/1.1/
  • http://ns.adobe.com/pdf/1.3/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/rights/

Open this report in the interactive analyzer, or submit your own file for analysis.