Malicious PDF — malware analysis report

Heuristics 5

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://leonvi.ru/wix?keyword=showbox+apk+2015+download

  • http://fusekimutoxi.sportsontheweb.net/65369315801.pdf
  • http://gufebuxixubo.iblogger.org/decimals_worksheets_for_grade_5.pdf
  • http://zexawabezazojot.sportsontheweb.net/bestiario_pathfinder.pdf
  • http://surupumigo.mypressonline.com/xbox_a_button_stuck.pdf
  • http://vekowen.getenjoyment.net/jojokexotufekujug.pdf
  • http://wunegaxuduru.22web.org/2005_cadillac_cts_for_sale_in_saskatchewan.pdf
  • http://fupemagis.mywebcommunity.org/someone_like_you_piano_chords_ultimate_guitar.pdf
  • http://lufexaxoxak.mygamesonline.org/conversion_of_fe3_to_fe2.pdf
  • http://dosaxixapaxa.medianewsonline.com/2468854481.pdf
  • http://www.ascendercorp.com/
  • http://www.ascendercorp.com/typedesigners.html
  • https://dc58184e-bbba-402a-8e08-a55d552c8f3f.filesusr.com/ugd/0ebc1f_fd5d42fd8d684e458189f9944aeb4d26.pdf?index=true
  • https://s3.amazonaws.com/pasawe/gaggia_classic_pro_2019_review.pdf
  • https://s3.amazonaws.com/wujanozo/abinaya_mugen_rao_free.pdf
  • https://s3.amazonaws.com/badodemebo/gesakimatedadufuvaza.pdf
  • https://a5a7f18c-b887-48a0-80cc-3627c14345d5.filesusr.com/ugd/609f59_eda2364b8e04405cb80e179fd39a6674.pdf?index=true
  • https://7ae774ad-b64d-4473-a0b1-aa0db1e39e83.filesusr.com/ugd/3e7897_6810a5c03f5549aca2ad1ea1e3258a77.pdf?index=true
  • https://s3.amazonaws.com/wamatasamegu/fividegasisuvupuf.pdf
  • http://soranodabiwegi.myartsonline.com/89941152189.pdf
  • https://s3.amazonaws.com/fekife/33305562514.pdf
  • https://s3.amazonaws.com/jusuberu/bullet_raja_movie_hd_video_song.pdf
  • https://f77c8dad-41d7-4a8f-8d8d-c05149a3a236.filesusr.com/ugd/36d413_ca99aa68b8f141deaf85140fcb1266d2.pdf?index=true
  • https://85d2c5a2-fc31-4f76-86b4-4ebe2abe2bf4.filesusr.com/ugd/a8cc01_eefc2ee93c2b4b198e4f114b96870548.pdf?index=true
  • https://s3.amazonaws.com/vezumobigodub/35124392908.pdf
  • https://s3.amazonaws.com/kitakilesa/94_game_answers_things_associated_with_brazil.pdf
  • http://wowulikuvej.rf.gd/mcgraw_hill_education_algebra_1_answers.pdf
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • http://purl.org/dc/elements/1.1/
  • http://ns.adobe.com/pdf/1.3/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/rights/
  • http://scripts.sil.org/OFL

Open this report in the interactive analyzer, or submit your own file for analysis.