Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dafemum.ru/strik?utm_term=how+to+fix+a+samsung+tablet+that+won%2527t+turn+on+or+charge PDF link annotation

  • http://albl.ru/stick_it_cast_real_gymnastsjp6tr.pdfIn PDF document text
  • http://portkamesto.site/constitucion_mexicana_de_1917_originalganz9.pdfIn PDF document text
  • http://jixewelo.scienceontheweb.net/difference_between_authentication_and_authorization_in_information_security.pdfIn PDF document text
  • http://pinenud.mygamesonline.org/kreatywny_angielski_dla_dzieci.pdfIn PDF document text
  • http://vomamafawib.scienceontheweb.net/addition_and_subtraction_grade_1_worksheets.pdfIn PDF document text
  • http://domavera.ru/98621801564zwy45.pdfIn PDF document text
  • http://shtancircul.site/54060963373xu8i0.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://5c839259-519f-4cee-a1a2-6639d654070b.filesusr.com/ugd/140efa_ae79a08bf3bc47fd8a751731bdd7d240.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2e47a40e-7d2b-4f11-9bcc-337b869804ba/82695950497.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/363f9d79-bfca-4b1a-88ff-b0b3592de133/is_software_testing_a_good_career_option.pdfIn PDF document text
  • http://salilizuvozel.rf.gd/66309815423.pdfIn PDF document text
  • http://nejesezape.myartsonline.com/how_to_write_23_hundredths_in_decimal_notation.pdfIn PDF document text
  • https://e4da1597-3bb3-488b-9226-7c2c9e06e9ce.filesusr.com/ugd/db5d73_58492f2b46384079aec10ff40092967d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/79bc2ce2-26b0-4be2-a945-0309cb54f12e/top_down_vs_bottom_up_approach_in_network_design.pdfIn PDF document text
  • https://d0bf7e8b-5449-41c0-93e9-161603c0719f.filesusr.com/ugd/197ed4_a705cb9b07014600914768193d9b684c.pdf?index=trueIn PDF document text
  • http://zifiwezuxibis.rf.gd/gaxerimidixokimupumon.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/18a6d273-7323-4174-90a3-b4d782a5b1b0/how_long_to_cook_a_6_pound_prime_rib_on_a_rotisserie.pdfIn PDF document text
  • https://8bbfbdb8-1895-4472-a1c6-9e834ce25a60.filesusr.com/ugd/7deb27_63bf69a38aa94f0c8f993ce1c57ecdca.pdf?index=trueIn PDF document text
  • https://8f6f9f04-f977-4239-955d-f6aecf2dd879.filesusr.com/ugd/81cd61_42d690badd454a3cb5bb55816f8ce921.pdf?index=trueIn PDF document text
  • https://ec560393-4650-4708-bf0c-d08fceb8458c.filesusr.com/ugd/ca69db_db1db58b958e4e92a735cb0a9970adcd.pdf?index=trueIn PDF document text
  • http://bawawajabatura.epizy.com/determine_crystal_reports_runtime_version.pdfIn PDF document text
  • https://a98f38e8-5810-4fc9-be6a-c3d78c7c4f9f.filesusr.com/ugd/921909_ca28e508cecc4a2c89ae5560c994f3c7.pdf?index=trueIn PDF document text
  • https://d2ea4bfc-f92a-4379-acf2-d9b69981ddb7.filesusr.com/ugd/739437_6c20c4eebebf4e52874e513d46e05fe5.pdf?index=trueIn PDF document text
  • https://3dbd840c-7861-42b4-b064-af52d1d2f4eb.filesusr.com/ugd/86319b_c9a28f72999c4c8785a31f8955fbc4db.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.