Malicious PDF — malware analysis report

Heuristics 5

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• ClamAV scan did not complete info CLAMAV_SCAN_INCOMPLETE
  ClamAV scan on this file did not complete (ClamAV error (exit 2)); the verdict reflects only static heuristics. The result is not cached so a later submission will retry the scan.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://golowaki.ru/aws?utm_term=john+deere+d130+parts+manual

  • http://austritkfa.com/ionic_bonds_practice_worksheet_answer_key3s1ey.pdf
  • http://bnl-jobs.com/28653935687d5g3i.pdf
  • http://indital.fun/calculus_by_thomas_10th_editionkhxay.pdf
  • http://mavitrade.com/36732899440wksv2.pdf
  • http://musc-media.xyz/ditodetofukowavogutobijasz8jh6.pdf
  • http://extrameets.fun/13512303829j49cb.pdf
  • http://forpost-electrica.ru/silexieili8.pdf
  • https://uploads.strikinglycdn.com/files/14cd5ac3-2bfe-4ae1-bd47-a269b17c797e/39856214800.pdf
  • https://uploads.strikinglycdn.com/files/e1601d07-0be6-4eb0-9c57-62d3eadd5ce6/68082893385.pdf
  • https://89e5ed4a-33eb-42a6-b5f1-9fc07ea1e15b.filesusr.com/ugd/ff68bb_23e733b6272243209632658f7ce16705.pdf?index=true
  • https://67dec473-0a9c-497c-80b1-62a4c84c5046.filesusr.com/ugd/0aab01_53574c9dc0cb45438e72fc003b6e6c06.pdf?index=true
  • https://uploads.strikinglycdn.com/files/b069dad2-4a7b-42fd-ae8c-38dbbe2e5676/which_would_hit_the_ground_first_a_bowling_ball_or_a_feather.pdf
  • https://uploads.strikinglycdn.com/files/03c48d11-2e68-426b-b0e3-1bd6e712a85e/62651538701.pdf
  • https://uploads.strikinglycdn.com/files/cc523f9b-d738-493b-ae76-2e04c5260032/dungeons_and_dragons_starter_set_free.pdf
  • https://uploads.strikinglycdn.com/files/93d8e207-7dbf-4bc5-8df1-54a34eba03d4/fawilem.pdf
  • https://uploads.strikinglycdn.com/files/f3d3e912-dbd3-4a8a-b53f-ffb571ef9844/how_to_replace_watch_bands.pdf
  • https://c301b42c-deab-4116-afcd-a09dd0728425.filesusr.com/ugd/4bb894_9707a9bf69f9480780936f32a161c422.pdf?index=true
  • https://uploads.strikinglycdn.com/files/ac978d4d-fc24-44e8-ab74-947e2009a993/the_burning_bridge_wrightsville_pa.pdf
  • https://uploads.strikinglycdn.com/files/be3f8cfe-073a-4bf9-9dcc-70bb9adb90c9/sabofabomu.pdf
  • https://uploads.strikinglycdn.com/files/58ef75fa-d06f-4340-994f-3a932b46198d/insignia_ns-dxa3_manual.pdf
  • https://uploads.strikinglycdn.com/files/9629ccb2-7251-4c4a-baae-dab5196c5cba/linker_and_loader_ppt_download.pdf
  • https://uploads.strikinglycdn.com/files/eb1019a7-a557-4248-9bfc-3e2a3c2dec76/black_and_decker_40v_lst136w.pdf
  • https://e5baaea7-7007-41de-9367-4ebf3ed55875.filesusr.com/ugd/8e1900_938ff75cb56f4debab09e7dfa1b97034.pdf?index=true
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • http://purl.org/dc/elements/1.1/
  • http://ns.adobe.com/pdf/1.3/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/rights/

Open this report in the interactive analyzer, or submit your own file for analysis.