Malicious PDF — malware analysis report

Heuristics 5

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://kuzutuzo.ru/wix?keyword=mors+certa+hora+incerta+pronunciation

  • http://zutatowatipo.mywebcommunity.org/zevivugexojexuluxiri.pdf
  • https://bovedadeno.weebly.com/uploads/1/3/4/3/134320630/fokusuzeloju_nivubi_makodupuxiru_sofatesigiw.pdf
  • https://xuredetinumimo.weebly.com/uploads/1/3/4/6/134630251/eade45a.pdf
  • https://tuwebuliwarukor.weebly.com/uploads/1/3/5/4/135400964/busuborusa_jipilugefuror_revesido_bezas.pdf
  • https://dekodisiga.weebly.com/uploads/1/3/6/0/136051758/goxuxigiras_josazoxisixup_lujebamakagas_tukotuxad.pdf
  • http://www.ascendercorp.com/
  • http://www.ascendercorp.com/typedesigners.html
  • http://www.daltonmaag.com/
  • http://tasodeporojunez.epizy.com/substance_abuse_counselor_resume_templates.pdf
  • https://850a36a1-966c-46c3-86ed-e15bcb5778a7.filesusr.com/ugd/ede58b_0adae6bbf3d14e3b89b048ee782ad4b9.pdf?index=true
  • http://bisidajidosetuj.rf.gd/maths_riddles_with_answers_for_class_7.pdf
  • https://21e323bd-7fdd-46e9-a6c7-4880e76d7610.filesusr.com/ugd/0a51c1_a84524e0b7d74b62997f81ba90f412fc.pdf?index=true
  • https://bf5f3f24-cfb9-4aec-9f01-83e6d863dc5b.filesusr.com/ugd/1f4526_8e1be6fdc19a482c8e4b94351a42fbf6.pdf?index=true
  • http://kovawasokagi.epizy.com/a_summer_s_tale_movie.pdf
  • https://68358877-4ee6-4e53-94f7-4bd9665c1f53.filesusr.com/ugd/3bbd68_2da0a096006e4606b4c3b219797a4be6.pdf?index=true
  • http://jisevara.rf.gd/1987056724.pdf
  • http://depegiwisa.epizy.com/27285286370.pdf
  • http://levipazik.epizy.com/9085672805.pdf
  • http://zisemofojakuvew.epizy.com/3344048815.pdf
  • http://biwosagamivi.myartsonline.com/vezefifofumifej.pdf
  • http://beninoduvewer.epizy.com/communication_meeting_agenda_template.pdf
  • http://wodijoparipo.rf.gd/94348703480.pdf
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • http://purl.org/dc/elements/1.1/
  • http://ns.adobe.com/pdf/1.3/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/rights/
  • http://scripts.sil.org/OFL

Open this report in the interactive analyzer, or submit your own file for analysis.