Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://resalured.ru/strik?utm_term=data+science+course+average+salary+in+india PDF link annotation

  • http://fojukivijivik.medianewsonline.com/can_you_make_pie_dough_in_a_kitchenaid_mixer.pdfIn PDF document text
  • https://teduraxiwerul.weebly.com/uploads/1/3/2/6/132681384/fivilaxaxufa.pdfIn PDF document text
  • https://wosubazaroden.weebly.com/uploads/1/3/0/8/130813518/196eef1dd620cfc.pdfIn PDF document text
  • https://vajugape.weebly.com/uploads/1/3/4/7/134767319/nowagixapegid.pdfIn PDF document text
  • http://tejovotemikodes.getenjoyment.net/what_do_you_do_when_your_kindle_wont_turn_on.pdfIn PDF document text
  • http://wumewil.sportsontheweb.net/australia_post_catalogue.pdfIn PDF document text
  • http://jolidulikan.scienceontheweb.net/tabla_de_calibres_de_lamina_de_acero_inoxidable.pdfIn PDF document text
  • https://pobifixakije.weebly.com/uploads/1/3/4/4/134445477/nopiroge-fenakoduv.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/3cfde823-1059-4524-8447-1c2682edc6f3/will_stocks_continue_to_rise.pdfIn PDF document text
  • https://ffcd7f67-9b43-45c2-8e44-b15cca9583b8.filesusr.com/ugd/48bf55_cdcc23d0064b4de2aa13c08498981965.pdf?index=trueIn PDF document text
  • https://3794eb9c-cc8b-492c-aecc-44533f76aaa6.filesusr.com/ugd/1ee69b_c36de3932f1a4cb89e1807bee1b74164.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/4b977a2f-7947-4e3d-a89a-c6658303242b/jamufa.pdfIn PDF document text
  • https://32cf4326-ba62-484c-a3ca-05d02c2dd2e5.filesusr.com/ugd/0b46e6_f8200cbc031f478cb75d695f655e4630.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/44c0eebd-fe8b-4d2e-be37-e828062b4b4b/mechanical_engineering_salary_in_india_quora.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f3f6c1e9-7b47-480c-85fc-b72e33f10d34/43419414374.pdfIn PDF document text
  • https://580b68e3-2104-4118-ae5b-4f285de1c062.filesusr.com/ugd/dad7b5_73684d4048d84285891ea21a72dd4349.pdf?index=trueIn PDF document text
  • https://49b7c339-fea6-4bb3-bf7b-ca47af5263df.filesusr.com/ugd/6ca12d_946c96af94d3401794edcb2c06953f67.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/534e529e-6b74-4e10-b070-5eb03df15c81/35627382961.pdfIn PDF document text
  • http://desovizipelo.onlinewebshop.net/votopuzozelibasaxiv.pdfIn PDF document text
  • https://121f8fc1-d270-4171-a721-8ccd656fc20f.filesusr.com/ugd/2ca22b_684565675f0f44ca999e16037acc0b6d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/80496a74-fe85-40e5-858b-0978531dce8a/56923427647.pdfIn PDF document text
  • https://a4edf7fa-b057-49b5-8014-e5fd436fbef3.filesusr.com/ugd/c8b2c5_1b69927b9c98493eb1d4b459ce7291d0.pdf?index=trueIn PDF document text
  • https://f84ffea9-2755-49c2-9cb5-47ca8b55fe65.filesusr.com/ugd/0adedf_130e4e422248425a82f3c95939ce8198.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/6d849e59-1881-4304-bf24-3ee0eaa730e2/vigegigafawutibubor.pdfIn PDF document text
  • https://2489a575-72f7-492f-b117-28cfe4a4d2a3.filesusr.com/ugd/d81705_8356f5eab7b546b685c856553844c520.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.