Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://zajinet.ru/award?keyword=paganini+caprice+24+violin+pdf PDF link annotation

  • http://kyhni.site/tosuwifavujenilifoderogipsz2gg.pdfIn PDF document text
  • http://kernig.store/intuit_mint_remove_transactiondwj0r.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://22520ec4-2132-45a5-98b8-54db1b71d3ea.filesusr.com/ugd/b33b96_551205b86af1423e8728a6ed272c66fb.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/60f1d6d0-a084-4b37-95d4-28d9ca7891c8/29762929661.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cae25b92-b8f8-4a5d-99f3-10170532f7e4/93160867740.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/213bb688-ac88-45ee-9ffb-43a4f86d7852/niwemobozomon.pdfIn PDF document text
  • https://s3.amazonaws.com/mexavofezoxi/tamil_movie_video_songs_in_4k.pdfIn PDF document text
  • https://s3.amazonaws.com/robumuduluwise/backward_caste_list_in_karnataka.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c449b484-e468-445d-9ac6-a1551fcc3364/blank_world_map_with_oceans_marked_in_blue.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9e98ae65-2f25-4c54-b166-eb8b6a0587e9/what_is_the_meaning_of_teeth_falling_out_in_dreams.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bf2a2ea2-eb8a-44b3-8ee4-513309ec91b4/what_is_the_formula_for_finding_initial_velocity.pdfIn PDF document text
  • https://78151a86-a557-4e49-81aa-a2539eea45c7.filesusr.com/ugd/204f4f_081b3eac3a264cf9a69c8d24ecbb0119.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/sumesawoxajew/bafoxiwojipujoreroxel.pdfIn PDF document text
  • https://ce099f17-eb12-430b-a452-8d789b3ee5a8.filesusr.com/ugd/aef5b7_bbc12fd9c0194f829bbfe78ab7817cec.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/84a4edd8-80cb-4041-8931-298fe38afbe0/18366796313.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4ff06c05-068e-4ce6-9d78-6ecb6e623f36/kohler_20kw_diesel_generator_manual.pdfIn PDF document text
  • https://s3.amazonaws.com/xomepixo/tasibidobulukolonokori.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e4ac8b7a-2d29-4d2d-a4d2-36e3c3047dab/plantronics_cs55_headset_battery.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/49e92efb-d582-429f-b752-947958d59fcc/ramokidi.pdfIn PDF document text
  • https://s3.amazonaws.com/lorugipopuxe/what_is_the_wedding_tradition_of_jumping_over_a_broom.pdfIn PDF document text
  • https://c31d65df-273c-4bcc-acfb-7b03b0724b99.filesusr.com/ugd/e7e4a0_d614c2a04bce48d69a26adc561423efa.pdf?index=trueIn PDF document text
  • https://1c514d3f-4aca-4c14-a2cc-94ef866bc6c7.filesusr.com/ugd/860217_01166fe7913b477caab281fda6ec12fe.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/f43197f0-bdb7-482b-ad4b-e4a07b85536a/best_replacement_seat_for_schwinn_airdyne.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c7b8b201-75c7-49ee-af3e-9e089f12ff4b/32772047713.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.