Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://kuzutuzo.ru/strik?utm_term=norton+anthology+of+american+literature+volume+c+pdf PDF link annotation

  • http://idem-peshkom.ru/27840738524324aa.pdfIn PDF document text
  • https://wiwanozamo.weebly.com/uploads/1/3/4/3/134306351/xiniju-favaleliguw-xuvaguxomov-xolewuwakenivo.pdfIn PDF document text
  • https://sedogosep.weebly.com/uploads/1/3/4/4/134486754/zifofo-rakimup-tuzum.pdfIn PDF document text
  • https://cdn.sqhk.co/pijajawopoji/FZjhmpg/wowowufewipiti.pdfIn PDF document text
  • https://sulasaboxa.weebly.com/uploads/1/3/4/7/134767053/jagewalixivunut.pdfIn PDF document text
  • http://eurofamily.pro/how_to_convert_diono_radian_to_boosterq6m5g.pdfIn PDF document text
  • http://bigswinner.space/pikekawededumudajatawu6n0tl.pdfIn PDF document text
  • https://dasasaperot.weebly.com/uploads/1/3/4/6/134665710/xejopivegetep_puvijazumalufo_sepisusevuveb.pdfIn PDF document text
  • https://jowidizikut.weebly.com/uploads/1/3/0/8/130874332/2864920.pdfIn PDF document text
  • https://pumutetigowon.weebly.com/uploads/1/3/4/6/134699291/galatewuwoje.pdfIn PDF document text
  • https://cdn.sqhk.co/mekurapiw/ibsyEC2/bubiriz.pdfIn PDF document text
  • https://cdn.sqhk.co/tigixexaxi/gmhdMjj/cash_app_card_atm_withdrawal_fee.pdfIn PDF document text
  • https://cdn.sqhk.co/feketukadoz/KZygdjg/codashop_user_id.pdfIn PDF document text
  • http://muzoc.xyz/franny_and_zooey_book_coverersz8.pdfIn PDF document text
  • https://cdn.sqhk.co/pumafuki/haXVjW6/42058621216.pdfIn PDF document text
  • http://ryursew.space/espacios_e_intercambios_vocabulairezx9pn.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://56db2a4d-09ce-4ff6-a558-abb1d6727cd4.filesusr.com/ugd/003b86_f328b9882acf42f3a6f7c4221641f532.pdf?index=trueIn PDF document text
  • https://677e6977-fc43-48b2-ac81-16e478c8573b.filesusr.com/ugd/3750c2_3c266728c56c4d4f9c9b7c2e968b9c87.pdf?index=trueIn PDF document text
  • https://8b2103c5-345b-48fd-98e3-f19c90c4efd0.filesusr.com/ugd/0e2875_47e311bce19943439933942525777668.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/7871263a-2fda-4946-9506-561885b8a4d5/simplicity_regent_38_parts_diagram.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/30810bd6-61f7-4188-8238-25a0a5de4266/how_to_type_in_google_docs_offline.pdfIn PDF document text
  • https://8b83d164-5e56-46cc-b941-48f48810ddf3.filesusr.com/ugd/76ce43_e1ae704841d1452c8bc22066c51dd656.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/7dc70c5f-13f9-4f62-8336-1a444262ce41/mapetiwivobib.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.