Malicious PDF — malware analysis report

Heuristics 6

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• ClamAV scan did not complete info CLAMAV_SCAN_INCOMPLETE
  ClamAV scan on this file did not complete (ClamAV error (exit 2)); the verdict reflects only static heuristics. The result is not cached so a later submission will retry the scan.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://zajinet.ru/strik?utm_term=epson+xp+800+ink+pad

  • https://static.s123-cdn-static.com/uploads/4476140/normal_60031e35b64eb.pdf
  • https://wewosidexavita.weebly.com/uploads/1/3/4/6/134648598/sugalowiji.pdf
  • https://rojemazef.weebly.com/uploads/1/3/4/6/134666767/vokiluxalolik-xabosojotox.pdf
  • https://static.s123-cdn-static.com/uploads/4490930/normal_5ff8907d0965d.pdf
  • https://dibevapanowodi.weebly.com/uploads/1/3/0/7/130776811/zumoputorijobobegib.pdf
  • https://static.s123-cdn-static.com/uploads/4375342/normal_5ffb244d5787b.pdf
  • https://gafeziluwer.weebly.com/uploads/1/3/4/3/134310472/sezaroti-wimixagebenegu.pdf
  • http://vuzuvolumupapiz.22web.org/how_to_detail_your_car_interior_yourself.pdf
  • https://cdn-cms.f-static.net/uploads/4369656/normal_6022ef96b22d6.pdf
  • http://ziragekezazu.iblogger.org/beauty_and_the_beast_original_story_book.pdf
  • https://gogabaxada.weebly.com/uploads/1/3/4/8/134852864/4214413.pdf
  • https://static.s123-cdn-static.com/uploads/4369189/normal_5fcd31d58ecf4.pdf
  • https://jadojojipolukot.weebly.com/uploads/1/3/5/3/135337887/72c5a6ec1.pdf
  • https://uploads.strikinglycdn.com/files/b4d4c62f-d155-4e27-88cc-32661ccdf3d8/beats_studio_wireless_model_b0501_ear_pads.pdf
  • https://uploads.strikinglycdn.com/files/126e8faa-d983-4ca1-b428-e936a4798b46/vejiputipovelut.pdf
  • https://uploads.strikinglycdn.com/files/59c96da7-e53f-4cdf-a6c8-5670eed64427/tipping_point_science_definition.pdf
  • https://uploads.strikinglycdn.com/files/58612a31-1dae-49d3-aa98-929d46f752d1/porutuzaguworinapoduwovix.pdf
  • https://uploads.strikinglycdn.com/files/9f29d472-b250-4c46-8219-cd8bbc828bfb/how_to_find_hp_deskjet_2600_password.pdf
  • https://uploads.strikinglycdn.com/files/25a07f8e-64bc-4166-b9d4-c216bb9adc25/the_three_billy_goats_gruff.pdf
  • https://uploads.strikinglycdn.com/files/9675e394-be47-4c58-89fe-8f41663f51b9/officejet_pro_8600_printer_troubleshooting.pdf
  • https://uploads.strikinglycdn.com/files/c726a19b-3117-41ef-9aed-5fb5f71435d8/3656000829.pdf
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • http://purl.org/dc/elements/1.1/
  • http://ns.adobe.com/pdf/1.3/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/rights/

Open this report in the interactive analyzer, or submit your own file for analysis.