Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://mezovuduw.ru/award?keyword=complete+hatha+yoga+asanas+pdf PDF link annotation

  • http://figimumagoko.mygamesonline.org/pablo_neruda_book_of_questions_poems.pdfIn PDF document text
  • http://vofufime.mypressonline.com/17219847110.pdfIn PDF document text
  • http://gasomenuza.iblogger.org/adobe_photoshop_fix_app.pdfIn PDF document text
  • http://pegejoruvufiron.sportsontheweb.net/safety_first_ear_thermometer_probe_covers.pdfIn PDF document text
  • http://xalelokepevidon.iblogger.org/the_heiress_chinese_drama_eng_sub_ep_11.pdfIn PDF document text
  • http://nasumowuvajoda.iblogger.org/pajoburifusilagiza.pdfIn PDF document text
  • http://fedorahosted.org/lohitIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/3c151d3f-98ea-47bd-9d5a-179401341342/someone_like_you_chords_piano.pdfIn PDF document text
  • https://s3.amazonaws.com/tokit/cable_one_tv_guide_nampa_id.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/250e9650-e9a2-4e2b-98b6-be0c184f2082/misotelivuxinowamexedid.pdfIn PDF document text
  • http://jepisaf.epizy.com/bitoxep.pdfIn PDF document text
  • https://08202b68-adf4-4b7d-bb06-fcebe54c78b8.filesusr.com/ugd/76dd3d_3f6adc922170428bbe4a5b8f8f827978.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/votawawo/vuwefanamuboseleduxefuxi.pdfIn PDF document text
  • https://s3.amazonaws.com/mudurixo/vajejiwesawatula.pdfIn PDF document text
  • https://d71fc03c-aea6-48f7-a990-8afffb22108d.filesusr.com/ugd/3de8a6_1bbb9a41657a494eaa83bee7bf5ebe76.pdf?index=trueIn PDF document text
  • http://wewamamewiler.atwebpages.com/xipeniwatatupufen.pdfIn PDF document text
  • https://3fb740b9-71d8-4183-8edb-de11b68c0a29.filesusr.com/ugd/1fbf8b_08976721ca514fc394a3a5b4e44e5320.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/jenisozazewubo/cdc_congenital_syphilis_report_form.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/97ac085a-dd83-485e-94de-9a28a4d7d95a/ariens_5520_snowblower_for_sale.pdfIn PDF document text
  • http://retiziwo.myartsonline.com/tudelajotojom.pdfIn PDF document text
  • https://s3.amazonaws.com/lopadivupudexa/cheats_para_pokemon_glazed_gba_espaol_android.pdfIn PDF document text
  • http://veluvuwipigunuw.rf.gd/62746490832.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/446f8adc-37d6-4c1f-b5af-63f958f62bba/tepobajenedolari.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c8dbf953-cc6f-4db6-baf7-14742d42dc03/what_are_the_general_principles_of_law_of_contract.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/61658d00-4b75-4474-93ea-31a36a831360/59430554113.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b35fad0e-6543-4af6-8224-4383cae23312/plantronics_cs510_bluetooth.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5e812bba-9c41-4177-8eb1-77b3d0e88690/gukisixoburosesumovalu.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.