Malicious PDF — malware analysis report

Heuristics 5

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
  Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://mindforyou.org/uploads/1/3/1/6/131636907/131636907.html#fool+for+you+sheet+music+pdf PDF link annotation

  • http://shopperevaluationsurvey.com/uploads/1/3/1/4/131405948/bijenexi.pdfIn PDF document text
  • http://mitchellglover.com/uploads/1/3/1/3/131398008/2854226.pdfIn PDF document text
  • http://fredericksburgghosts.com/uploads/1/3/1/0/131070983/75f621.pdfIn PDF document text
  • http://selambalaj.com/uploads/1/3/0/5/130551271/9474623.pdfIn PDF document text
  • http://stevenjdenton.com/uploads/1/3/0/6/130604694/5638520.pdfIn PDF document text
  • http://allperth.net/uploads/1/3/0/4/130436209/949320.pdfIn PDF document text
  • http://3003exposition.com/uploads/1/3/0/7/130739996/bonaxutaje_fepinagerego_letokafodos.pdfIn PDF document text
  • http://oteccoachinglive.com/uploads/1/3/0/4/130483445/9b3cb1c3de782.pdfIn PDF document text
  • http://memeunion.org/uploads/1/3/0/2/130291434/51d2ce7348c.pdfIn PDF document text
  • https://nocdn.com/score/stats/view?score_id=5107203In PDF document text
  • https://musescore.5In PDF document text
  • https://musescore.0200000000000000004163336342344337026588618755340576171875},{In PDF document text
  • https://musescore.040000000000000000832667268468867405317723751068115234375In PDF document text
  • https://musescore.png@500x660?no-cache=1579865928&bgclr=ffffffIn PDF document text
  • https://creativecommons.0/In PDF document text
  • https://musescore.jsonp?revision=1527103124&no-cache=1587122933In PDF document text
  • https://musescore.youtube.99In PDF document text
  • https://musescore.mp3?revision=1527103124&no-cache=1587122933In PDF document text
  • https://musescore.item-list:last-childIn PDF document text
  • https://musescore.05000000000000000277555756156289135105907917022705078125In PDF document text
  • https://musescore.1In PDF document text
  • https://musescore.netIn PDF document text
  • https://musescore.1000000000000000055511151231257827021181583404541015625},{In PDF document text
  • https://musescore.0In PDF document text
  • https://musescore.midIn PDF document text
  • https://musescore..)ThisIn PDF document text
  • https://musescore.png@180x252?no-cache=1579865928&bgclr=ffffffIn PDF document text
  • https://musescoreIn macro / runtime command snippet
  • https://musescore.com/static/musescore/scoredata/gen/3/0/2/5107203/86aadfe00034bb93c8eed951afaff58eafef8140/score_0.com/user/28818643In PDF document text
  • https://musescore.com/static/musescore/scoredata/gen/3/0/2/5107203/86aadfe00034bb93c8eed951afaff58eafef8140/scoreIn PDF document text
  • https://musescore.com/static/public/img/musescore/piano_rollIn PDF document text
  • https://musescore.com/user/28818643/scores/5107203/embedIn PDF document text
  • https://musescore.com/song/fool_for_you-2049245In macro / runtime command snippet
  • https://www.com/static/musescore/scoredata/gen/3/0/2/5107203/86aadfe00034bb93c8eed951afaff58eafef8140/score.com/static/musescore/userdata/avatar/default.com/user/28818643/scores/5107203In PDF document text
  • https://musescore.musescore.com/static/musescore/scoredata/gen/3/0/2/5107203/86aadfe00034bb93c8eed951afaff58eafef8140/space.com%2Fuser%2F28818643%2Fscores%2F5107203In PDF document text
  • https://musescore.com/static/musescore/scoredata/gen/3/0/2/5107203/86aadfe00034bb93c8eed951afaff58eafef8140/score_0.200000000000000011102230246251565404236316680908203125In PDF document text
  • https://musescore.com/ug/In PDF document text
  • https://musescore.comIn macro / runtime command snippet
  • https://www.com/user/28818643/scores/5107203In PDF document text
  • https://musescore.org/licenses/by-nc/4.com/watch?v=L-42iZef7y4In PDF document text
  • https://musescore.com/user/21585386/scores/5634470/piano-tutorial?from=youtube_shareIn PDF document text
  • https://musescore.ultimate-guitar.com/song/talking_to_the_moon-1844428In PDF document text
  • https://musescore.com/static/musescore/userdata/cover/5/d/5/28818643.jpg?cache=0In PDF document text
  • https://musescore.com/artist/bruno_mars-150429In PDF document text
  • https://musescore..youtube.com/user/21585386/scores/5634470/piano-tutorial?from=youtube_shareIn PDF document text
  • https://musescore.com/user/28818643In PDF document text
  • https://musescore.com/static/musescore/scoredata/gen/3/0/2/5107203/86aadfe00034bb93c8eed951afaff58eafef8140/score_0.com/user/28818643/scores/5107203In PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text

  +4 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.