Malicious PDF — malware analysis report

Heuristics 5

• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Callback phishing phone lure medium SE_CALLBACK_LURE
  Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://bologen.ru/wix?keyword=vinayaka+mission+university+certificate PDF link annotation

  • http://valupimabo.22web.org/nadelivuranusagin.pdfIn PDF document text
  • http://fetidasobi.iblogger.org/close_up_b1_student_s_book_answers.pdfIn PDF document text
  • http://semazolowogafoj.22web.org/kukodutip.pdfIn PDF document text
  • http://lupazul.mywebcommunity.org/fupefitosazesulupedo.pdfIn PDF document text
  • http://pomanonorajalam.22web.org/ahmedabad_mirror_epaper_yesterday_download.pdfIn PDF document text
  • http://derilezin.sportsontheweb.net/ps3_holding_eject_button.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://6b54b0b2-91db-43cc-88c8-bbc4f7e20b37.filesusr.com/ugd/a773aa_49a304f580904d898255aea39fd88515.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/vezumobigodub/basilisco_de_roko.pdfIn PDF document text
  • http://viwuwijagabote.myartsonline.com/how_to_format_a_professional_letter_of_recommendation.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1cf46d74-8231-457c-af73-947c28d482a3/wunumofa.pdfIn PDF document text
  • http://rigidafavubo.myartsonline.com/salems_lot_1979_cast.pdfIn PDF document text
  • http://towupew.epizy.com/bachon_ki_kahaniyan_mp4_free.pdfIn PDF document text
  • https://4900ecec-7ac1-411c-be2c-b077674085c8.filesusr.com/ugd/493135_6080e960aca44baf9d31d0a56f7a09e0.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/lovomijelun/3667196929.pdfIn PDF document text
  • http://buluzapatevade.epizy.com/how_to_connect_my_playstation_gold_headset.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8372ce3e-0e38-4164-b46a-5c8a3b6b897a/what_is_iliad_and_odyssey_all_about.pdfIn PDF document text
  • https://c6506652-bf5e-4f52-be36-03dbfaede22c.filesusr.com/ugd/f74919_8ae1128759934dd792f2d42ffd5b25a9.pdf?index=trueIn PDF document text
  • http://gezixerigalejeb.rf.gd/45778346931.pdfIn PDF document text
  • https://s3.amazonaws.com/limepusotanal/brand_plan_template_ppt_free.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.