Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://mezovuduw.ru/strik?utm_term=probabilidad+y+estad%25C3%25ADstica+para+ingenieros+sheldon+ross+pdf PDF link annotation

  • https://cdn.sqhk.co/rolileduvof/AhbZYhb/download_aplikasi_zarchiver_pro_apkpure.pdfIn PDF document text
  • https://cdn.sqhk.co/rujiwujik/geEKgis/71356364300.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4485823/normal_5fcfa7c727f03.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4403533/normal_604b5657276c4.pdfIn PDF document text
  • https://cdn.sqhk.co/xaripisi/a4fjik3/retro_arcade_game_reviews.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4414873/normal_60355c6ea617c.pdfIn PDF document text
  • http://fijeveg.iblogger.org/beep_song_mp4.pdfIn PDF document text
  • https://cdn.sqhk.co/lulaxujik/YWmMjMt/steel_ball_yba_item.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4481403/normal_6035ef550454d.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://af18ad75-7652-4b25-b9e0-8da5fded0af1.filesusr.com/ugd/529385_3c2d56ba319247a1ac196c2e68cc2d74.pdf?index=trueIn PDF document text
  • https://49884795-3b66-401c-adaf-b59e999553af.filesusr.com/ugd/8bd6c9_92b3eead92074ef7a1f6539859859532.pdf?index=trueIn PDF document text
  • https://a82c121c-2200-4cd7-aff6-47cf910fdadb.filesusr.com/ugd/117c17_24b09240c5814400a3c9c1e0683a790d.pdf?index=trueIn PDF document text
  • https://247e77cc-5367-4382-8586-7c5891409f42.filesusr.com/ugd/2dbf5a_11f1fb5552524d42aa9c963b019b2383.pdf?index=trueIn PDF document text
  • https://67a4337f-2b79-4d04-9c1d-2578c80f4945.filesusr.com/ugd/964009_087423f03c384a8e85f151ee0aa337a7.pdf?index=trueIn PDF document text
  • https://a513df27-8ea1-49e5-9b48-af726a3c99b5.filesusr.com/ugd/c567c1_26a0525c79cf471e8b3fb7881a70f8fb.pdf?index=trueIn PDF document text
  • http://togaretib.epizy.com/dejunaf.pdfIn PDF document text
  • https://1d942ef5-affb-47d8-8f99-70a3d187b733.filesusr.com/ugd/3283b0_18c885a25ee445cda57e39bd6160f7b3.pdf?index=trueIn PDF document text
  • http://rivebop.epizy.com/set_top_box_android_wifi.pdfIn PDF document text
  • https://510adc33-753b-44c0-977e-8d34da8fcdd4.filesusr.com/ugd/5f4192_5e04beef95834b5eb93be7bdcf8e0e33.pdf?index=trueIn PDF document text
  • https://b564fea6-732e-489f-a029-a72dc6590de2.filesusr.com/ugd/6a4619_a51535859af247dfab5ec292a25a6529.pdf?index=trueIn PDF document text
  • https://0d3c4653-ec4b-4b04-9c20-59e348ba858e.filesusr.com/ugd/62200f_a095676534004868b0bc841d4ae853b7.pdf?index=trueIn PDF document text
  • https://359ea524-acbf-40a7-8d58-ee96a8f10bc8.filesusr.com/ugd/ca2e76_7a7e0ad5ef3946468989099c0ebff2e1.pdf?index=trueIn PDF document text
  • https://a95edb9d-21e5-46e4-bb1b-b1fdf66a5dae.filesusr.com/ugd/09e34a_d2ac4d3c7c4a44d9b6bd551ce8755cea.pdf?index=trueIn PDF document text
  • https://d572dbd6-ec42-402e-884a-3db6daac2318.filesusr.com/ugd/6a558d_681ebb8f3b4f4b09b4a90d21773072bd.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.