Malicious PDF — malware analysis report

Heuristics 5

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://nipisod.ru/strik?utm_term=how+to+use+matsui+dab+radio PDF link annotation

  • http://ribugiwegi.22web.org/53192048127.pdfIn PDF document text
  • http://tokibekojavo.22web.org/44399653057.pdfIn PDF document text
  • http://xovekofetovo.66ghz.com/the_water_cycle_worksheet_evaporation_condensation_precipitation.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/66c9b7af-89e2-4246-9b68-891e099069c2/cost_of_smart_board_for_classroom.pdfIn PDF document text
  • https://cd5075e9-4951-46bd-8d13-413fdd501c9b.filesusr.com/ugd/eceaf1_9cf7e047569d4354ba59ec6f5ab8d21e.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/pasutiz/75919145197.pdfIn PDF document text
  • http://meduzifovum.epizy.com/qatar_calendar_2020_with_holidays.pdfIn PDF document text
  • https://s3.amazonaws.com/feseni/symantec_data_loss_prevention_administration_guide_15.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/28b9a5fa-2b9e-40dc-9bef-6599b607a676/6186356669.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/665ba40e-d43a-4e4e-8d68-e430d2efabc8/robinson_crusoe_book_description.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c30c7b04-1e3f-46df-8235-10e4ac3e32e8/ryobi_14_cordless_chainsaw_review.pdfIn PDF document text
  • http://bisegigosos.epizy.com/82505881978.pdfIn PDF document text
  • https://f8b57e9d-e272-4783-b6f5-6420e6b93425.filesusr.com/ugd/886b73_7bbf4714a5a24d98b45f42fc396864db.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/kifutizijebuj/barbie_movies_in_tamil_dubbed_hd.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/862bceb9-a1a5-4c61-be4f-215be510cf25/when_you_wish_upon_a_star_my_son_pinocchio_lyrics.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8d1b71eb-3f0e-49e9-9adb-51e5075b945f/54161241460.pdfIn PDF document text
  • https://9334512a-4df1-45dc-8804-f0fa1d9e2a3d.filesusr.com/ugd/9466eb_d3ed1f372b2f49c78f17eae7ef9e7b89.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/42780439-0997-448c-af47-998a359e52bb/how_to_make_a_good_rap_song_on_garageband.pdfIn PDF document text
  • https://ca3ec1ac-6ff7-4c8f-ae0f-86a30d86e335.filesusr.com/ugd/3615fb_e153ba16c30e433ea9f41da5cd0729f9.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/389ed876-40d7-475e-907f-0b7703f83cb2/sadot.pdfIn PDF document text
  • https://s3.amazonaws.com/dojonuta/sniper_dotabuff_guide.pdfIn PDF document text
  • https://4b3b4da4-1145-40fd-8a04-0ac29766dab0.filesusr.com/ugd/6c6203_930098837d394a4da3c0e7db26caa5bc.pdf?index=trueIn PDF document text
  • https://3789e5f8-265e-48cd-8836-241a044b7ceb.filesusr.com/ugd/45ef7e_dbd9007c062b420d9c0c4c92fca63a32.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/zumezeviwakiz/metal_gear_solid_2_walkthrough.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c10910c6-3b93-46d2-8c74-f4272d865454/92560497177.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.