Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jumiwimov.ru/123?utm_term=acknowledgement+format+for+industrial+training PDF link annotation

  • http://erethiztzj.space/types_of_drag_in_aircraftwexz8.pdfIn PDF document text
  • https://tezijiso.weebly.com/uploads/1/3/4/6/134690371/bimefekupi_dofubusug_kilobeveg.pdfIn PDF document text
  • http://notdull-eng.online/daromopunelojuzefidknm9x.pdfIn PDF document text
  • https://rezapikuxodet.weebly.com/uploads/1/3/0/9/130969426/1a9efd.pdfIn PDF document text
  • http://bluebadgeapproval.com/download_primal_carnage22iic.pdfIn PDF document text
  • https://xidumalebuwun.weebly.com/uploads/1/3/4/8/134894794/jokota.pdfIn PDF document text
  • https://sapixokevabose.weebly.com/uploads/1/3/4/4/134498139/jaxoroxab_jatilijuxuvawa_jigonogik.pdfIn PDF document text
  • https://vejevidumuruje.weebly.com/uploads/1/3/5/3/135302175/mozokoloseti-feligaxarid-milogajowarani-jepobad.pdfIn PDF document text
  • https://rasogumelix.weebly.com/uploads/1/3/5/4/135400304/01ecb3f83a5d9d.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4403262/normal_5ff264bcc32cb.pdfIn PDF document text
  • http://autokenn.com/go_math_grade_5_workbook_online1o43t.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4413980/normal_60462451bf4ce.pdfIn PDF document text
  • https://gewasulupav.weebly.com/uploads/1/3/0/7/130740056/4fb789c185.pdfIn PDF document text
  • http://7lessons.fun/88978617195hnt0u.pdfIn PDF document text
  • https://liwavijej.weebly.com/uploads/1/3/4/3/134379327/gebofurikesox.pdfIn PDF document text
  • https://totovipuvo.weebly.com/uploads/1/3/2/7/132740708/685bf9b59d4973.pdfIn PDF document text
  • https://marizezibafive.weebly.com/uploads/1/3/4/8/134865590/b380f6f.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/1c843881-b1e7-4033-afc2-e994125dd2ff/can_you_cancel_sat_subject_test_scores.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2c72cc82-0ff0-4977-a22a-e780f8bb0eb0/night_shift_cast_season_2_episode_1.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1c6e2060-0cf3-48ac-81df-becde9cf9ac9/how_to_set_the_time_on_a_krups_savoy_coffee_maker.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4abd7495-e5e5-4295-b047-c7e53d60140b/how_long_to_fall_400_feet.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/adeee615-0221-40e1-b0b8-c27546afbbc7/25344071589.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b98862e4-399f-48b9-ae78-520d3bee7ac5/meade_lx200_8_schmidt-cassegrain_review.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1a449da5-c3b0-416b-a966-85ee0f5913e8/16286405008.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/df6b7779-2769-4f4d-966d-b7d071678cda/can_you_bake_in_a_copper_chef_pan.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/edd52ae7-0917-4e78-970c-9d128f8201d8/atem_setup_utility_software_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5706928e-c6fe-434e-8dca-2810e541ffba/have_the_relationship_you_want_ebook_free_download.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.