Malicious PDF — malware analysis report

Heuristics 5

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://gimoguvi.ru/123?utm_term=gcse+maths+online+worksheets

  • http://fajujefa.getenjoyment.net/lajasedanikewotekowe.pdf
  • http://joblanc.xyz/denelexixunavoxuxutejixz.pdf
  • http://bokaxakoz.sportsontheweb.net/65162797821.pdf
  • http://kikifikoxije.mypressonline.com/70409722493.pdf
  • http://gidedaz.iblogger.org/70515881578.pdf
  • http://legrand-spb.ru/how_to_fix_water_dispenser_not_hotxdrry.pdf
  • http://hh666o.site/67870459153zn37c.pdf
  • http://medgaj.com/what_genre_is_artemis_fowlphklu.pdf
  • http://www.ascendercorp.com/
  • http://www.ascendercorp.com/typedesigners.html
  • https://s3.amazonaws.com/pululusodogi/heroes_of_the_storm_genji_guide_deutsch.pdf
  • http://bokatamekal.rf.gd/bimanual_compression_of_the_uterus_video.pdf
  • https://s3.amazonaws.com/fukezavazuj/krups_coffee_maker_cleaning_mode.pdf
  • http://sudolurimav.epizy.com/29798267051.pdf
  • https://s3.amazonaws.com/sumesawoxajew/30030965824.pdf
  • https://s3.amazonaws.com/tigovatolis/farewell_party_email_template_to_coworkers.pdf
  • https://2ffa788b-df2f-461f-b9c5-573bec542745.filesusr.com/ugd/374ce0_5265512996224204a54d5fdcc37911b1.pdf?index=true
  • https://s3.amazonaws.com/pujinit/9555918563.pdf
  • https://6f2fb29c-15f2-4b08-b525-3eb91a7f0a41.filesusr.com/ugd/c3548c_ee10305ba15f49dc99934b0fe45aa100.pdf?index=true
  • http://jenetaponolinev.rf.gd/zevuzam.pdf
  • https://s3.amazonaws.com/peveziwoguxuzam/70977848379.pdf
  • https://c18d7360-3707-4bf1-9d6f-52ba7510fa17.filesusr.com/ugd/76cb06_2a5159e816ee412da485a214249c2f0e.pdf?index=true
  • https://s3.amazonaws.com/defipedibe/nie_boska_komedia_dantego.pdf
  • https://7ed754b6-a209-4558-9281-0032c7ee8ade.filesusr.com/ugd/4329d7_eca9cb9545fb4fcb8cf314f5fcaf8027.pdf?index=true
  • https://234d5d8d-19c9-4cab-a884-dd0775662658.filesusr.com/ugd/fb7225_840b730a113f4bc98231376c39234e08.pdf?index=true
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • http://purl.org/dc/elements/1.1/
  • http://ns.adobe.com/pdf/1.3/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/rights/
  • http://scripts.sil.org/OFL

Open this report in the interactive analyzer, or submit your own file for analysis.