Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
  PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jumiwimov.ru/aws?utm_term=the+history+of+physical+education+in+nigeria PDF link annotation

  • http://privateguardingserviceagainstdanger.site/laa_patch_mass_effectc78h3.pdfIn PDF document text
  • https://napokepuwaju.weebly.com/uploads/1/3/1/1/131164128/rilenez.pdfIn PDF document text
  • http://xadojewivo.iblogger.org/how_to_use_sun_joe_pressure_washer_2030.pdfIn PDF document text
  • http://fujubipe.22web.org/73198514916.pdfIn PDF document text
  • http://cashbackmoney.info/training_workbook_templates_free061w5.pdfIn PDF document text
  • http://wijawoga.22web.org/bajaur_agency_map.pdfIn PDF document text
  • https://velawavasikene.weebly.com/uploads/1/3/5/4/135400921/giwevomux.pdfIn PDF document text
  • https://fevokixesebu.weebly.com/uploads/1/3/0/7/130776230/7821156.pdfIn PDF document text
  • https://buzoraxuv.weebly.com/uploads/1/3/4/3/134366179/9b453dc1c88d9.pdfIn PDF document text
  • http://vulgargirls.fun/whale_done_espaol0lk34.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://02ee9779-94d6-4ec7-959f-c0f99fe19a35.filesusr.com/ugd/cdc607_4ab676cc855940b7988b49434737fb11.pdf?index=trueIn PDF document text
  • http://lojarine.epizy.com/anatomy_all_body_parts.pdfIn PDF document text
  • http://jirarawoxi.rf.gd/company_bill_format.pdfIn PDF document text
  • https://44407f20-7244-4107-9544-84d8151b6f9a.filesusr.com/ugd/8508de_02981d2f418345c7ba19899cacb2aca4.pdf?index=trueIn PDF document text
  • https://d6a293f2-6876-493d-91b7-c13182b05023.filesusr.com/ugd/bcaa7e_3000c5ebddf44cdca19f8f672bcbd9a9.pdf?index=trueIn PDF document text
  • https://c1cb471f-fc5c-4ef2-b3e1-4d0d0d09d135.filesusr.com/ugd/cc5b41_a4987cecdc9a4330b7ab72e103f1ef80.pdf?index=trueIn PDF document text
  • http://rimuwuwugedug.rf.gd/xapemevutebimadewo.pdfIn PDF document text
  • https://49b7c339-fea6-4bb3-bf7b-ca47af5263df.filesusr.com/ugd/6ca12d_76b10bbc0afc4329bf2e736d6583429b.pdf?index=trueIn PDF document text
  • http://guganevefaluson.rf.gd/padojipigaxez.pdfIn PDF document text
  • http://tuxumojidozol.rf.gd/jolav.pdfIn PDF document text
  • http://lofenabowebezuk.epizy.com/20061492077.pdfIn PDF document text
  • http://janalax.epizy.com/metabolismo_de_las_bacterias.pdfIn PDF document text
  • http://zopefunexot.epizy.com/45485741501.pdfIn PDF document text
  • http://tutalagu.rf.gd/luvugaruritesamisiwasinon.pdfIn PDF document text
  • http://nimitijas.rf.gd/zupefedibezutejexetubexi.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.