Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://leonvi.ru/award?keyword=boolean+algebra+in+computer+architecture+pdf PDF link annotation

  • https://bogilerilixami.weebly.com/uploads/1/3/5/3/135345361/jilokewej.pdfIn PDF document text
  • http://sanalunuguto.22web.org/guxenumanef.pdfIn PDF document text
  • https://cdn.sqhk.co/gubogezemazo/iighijd/dorotigawixeda.pdfIn PDF document text
  • https://wukajimodowel.weebly.com/uploads/1/3/0/8/130874313/4588012.pdfIn PDF document text
  • https://cdn.sqhk.co/zatufora/gcjaegi/zipusemozavimodolujena.pdfIn PDF document text
  • https://cdn.sqhk.co/jisepozidis/tMGX7hc/luke_combs_album_song_list.pdfIn PDF document text
  • https://cdn.sqhk.co/daxerarugak/gEgh8gd/xozekuj.pdfIn PDF document text
  • https://wadapunefivuda.weebly.com/uploads/1/3/4/3/134307948/ff0db5389c6bc47.pdfIn PDF document text
  • https://cdn.sqhk.co/jekuvobu/id9kQws/meteor_shower_animal_crossing_new_horizons_multiplayer.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://pafovipazatuk.rf.gd/sharper_image_super_wave_oven_manual.pdfIn PDF document text
  • http://waviwonagasa.epizy.com/getipunurijumelif.pdfIn PDF document text
  • https://b064d0e4-88d6-4b7e-8087-8ebf790fcba6.filesusr.com/ugd/ca32a8_3846bee1bdc746b0b7c208d10dc13ed0.pdf?index=trueIn PDF document text
  • http://xinovedef.rf.gd/risk_assessment_army_form_7566.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c52cf198-0fed-4bf7-b48e-fa56b80c1ab3/nijoxoxukukes.pdfIn PDF document text
  • https://af18ad75-7652-4b25-b9e0-8da5fded0af1.filesusr.com/ugd/529385_3fa7fb36a6934d0f867564cb1c123029.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/beb6f545-ac16-4cac-9a50-b28da6894d36/27245117841.pdfIn PDF document text
  • https://01c4c9a3-ee74-4db9-a65d-799443b8dbf1.filesusr.com/ugd/a64c8c_f685c68101f049029b5e28791a9cd097.pdf?index=trueIn PDF document text
  • http://pikarofuwab.epizy.com/protein_nmr_spectroscopy_practical_techniques_and_applications.pdfIn PDF document text
  • https://f815f12b-539f-4060-8ed9-abd2caada31b.filesusr.com/ugd/ceb2e8_527d4465778e45e3a9ff858e1b3b5a73.pdf?index=trueIn PDF document text
  • https://5c09c65f-4728-49e3-9562-8692e696fc4f.filesusr.com/ugd/32acb1_88472fc496fb474b95c146155db46c42.pdf?index=trueIn PDF document text
  • http://bufiwobad.rf.gd/programa_para_dirigir_honores_ala_bandera_en_secundaria.pdfIn PDF document text
  • http://pakolot.epizy.com/34965732260.pdfIn PDF document text
  • http://juzujodajemafa.rf.gd/old_bengali_album_songs_free.pdfIn PDF document text
  • http://vasogumideku.epizy.com/71555985101.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.