Malicious PDF — malware analysis report

Heuristics 5

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://resalured.ru/123?utm_term=4+pics+1+word+level+2146+answer

  • http://tomolijoponix.mypressonline.com/bidilirikaf.pdf
  • http://mumolazesinidix.getenjoyment.net/destiny_2_the_last_wish_raid_armor.pdf
  • http://ravasixojodari.mygamesonline.org/rawukalazanunavate.pdf
  • http://tigafik.mygamesonline.org/windows_server_2012_r2_datacenter_vs_standard.pdf
  • http://puveputado.sportsontheweb.net/bq-cc_17_sba3.pdf
  • http://www.ascendercorp.com/
  • http://www.ascendercorp.com/typedesigners.html
  • http://xuvekixofeku.onlinewebshop.net/basoxadafo.pdf
  • https://s3.amazonaws.com/wujodibu/amlodipine_besylate_davis_drug_guide.pdf
  • http://laniferes.epizy.com/see_below_the_information_requested.pdf
  • http://zikoliduxa.atwebpages.com/judetiwagizomiw.pdf
  • http://rerivumisiso.rf.gd/eternal_city_hiro_route_guide.pdf
  • https://s3.amazonaws.com/wukara/beginner_english_speaking.pdf
  • https://d99c26cc-8c68-456d-a039-1a26994c8d26.filesusr.com/ugd/105a8c_f76b6fa9fee44f0c8d668791ddffe30c.pdf?index=true
  • http://lakasixes.rf.gd/87386519455.pdf
  • https://s3.amazonaws.com/pizexopenaxu/computer_background_photo_free.pdf
  • http://wadexabosuzim.epizy.com/biblia_hebreo_espaol_descargar_gratis.pdf
  • https://s3.amazonaws.com/gidibesuxi/declaration_of_conformity_template_plastic.pdf
  • https://34886cf3-15ed-44db-93e8-8979dc7c4cd7.filesusr.com/ugd/ea2c45_b03cf10af3a3483a9f61ff93fb4f784e.pdf?index=true
  • https://0e9c393c-9feb-4465-ae9d-4486bea7a644.filesusr.com/ugd/4b68be_698a0cf7df8942679078ae12252e5dad.pdf?index=true
  • https://s3.amazonaws.com/tabobujimo/steelhead_fishing_report_orofino_idaho.pdf
  • https://s3.amazonaws.com/xovajukoxin/il_mulino_di_amleto.pdf
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • http://purl.org/dc/elements/1.1/
  • http://ns.adobe.com/pdf/1.3/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/rights/
  • http://scripts.sil.org/OFL

Open this report in the interactive analyzer, or submit your own file for analysis.