Malicious PDF — malware analysis report

Heuristics 4

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://fokemale.ru/award?keyword=anatomy+and+physiology+textbook+online+pdf PDF link annotation

  • https://figapizezedop.weebly.com/uploads/1/3/4/3/134364787/tigulusupozomonosibo.pdfIn PDF document text
  • https://dapazigozasonim.weebly.com/uploads/1/3/4/4/134466252/vifewopowubal_romepufudo_gasuperufibo_repodotogakipe.pdfIn PDF document text
  • https://kitigenuripoduj.weebly.com/uploads/1/3/1/0/131070171/pibufuvobogu.pdfIn PDF document text
  • https://zififawatef.weebly.com/uploads/1/3/4/3/134384507/zemodoxotu.pdfIn PDF document text
  • http://ziwewixowele.sportsontheweb.net/bootstrap_4_book_free_download.pdfIn PDF document text
  • https://mujiborabasovu.weebly.com/uploads/1/3/4/5/134590634/diwif.pdfIn PDF document text
  • http://bisibometixo.mywebcommunity.org/us_constitution_with_all_amendments.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/tutapaxi/unknown_market_wizards_audiobook_free_download.pdfIn PDF document text
  • https://s3.amazonaws.com/genedesowul/schwinn_gateway_28_hybrid_bike_target.pdfIn PDF document text
  • https://ecf1b359-4982-44d9-836f-7e6f5fec4aa1.filesusr.com/ugd/da15c8_17e950d647934dde9380c7b1b589ae37.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/nigimul/diwejejomesunuvawu.pdfIn PDF document text
  • https://38c8c62e-1823-4c1e-8220-bc61efcc8a1c.filesusr.com/ugd/c24b9b_201120dc4055485499ff68ea0e6ee042.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/wofaxil/adivasi_dance_video.pdfIn PDF document text
  • https://081e7fb2-604d-424b-9b75-a58d54a71a44.filesusr.com/ugd/abd6ea_c302980813ea4f4d8076742574ccbb3c.pdf?index=trueIn PDF document text
  • http://ratobewiwigu.atwebpages.com/old_testament_bible_study_guide.pdfIn PDF document text
  • https://s3.amazonaws.com/tojabixefova/vizio_sound_bar_2.1_built_in_subwoofer.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4d33b496-2f1d-49a0-908e-d3b8ad04dd50/manual_de_funciones_de_una_empresa_industrial.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/eb1b3597-5526-45df-8d94-7ac8cbf67b71/how_do_i_reset_my_keurig_coffee_maker.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.