Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://nipisod.ru/strik?utm_term=how+to+learn+salesforce+marketing+cloud PDF link annotation

  • https://buwipifigidorip.weebly.com/uploads/1/3/0/8/130813409/kojuvirevevoleda.pdfIn PDF document text
  • https://jajaleregonu.weebly.com/uploads/1/3/4/2/134235513/xudiparojopok.pdfIn PDF document text
  • https://noloxuxema.weebly.com/uploads/1/3/1/4/131453633/9327959.pdfIn PDF document text
  • http://topsalon.xyz/eq_blacksmithing_guide_2017dkrhl.pdfIn PDF document text
  • http://it50discount.pro/boardroom_limited_singapore_annual_reportdsu9e.pdfIn PDF document text
  • https://vidokabotofasi.weebly.com/uploads/1/3/4/8/134868814/685c7c.pdfIn PDF document text
  • https://kabawerabava.weebly.com/uploads/1/3/0/7/130774965/799a8a0dc.pdfIn PDF document text
  • https://fowowudajij.weebly.com/uploads/1/3/5/3/135312379/4170689.pdfIn PDF document text
  • https://tevupiju.weebly.com/uploads/1/3/4/8/134865653/patamowesesi_fojadelujiwi_sasugubowato.pdfIn PDF document text
  • http://repair-planshetov.ru/bbc_iplayer_android_failedfe261.pdfIn PDF document text
  • https://kifesajisibak.weebly.com/uploads/1/3/4/8/134884742/salatewe-mexiguzu-dafozezabu.pdfIn PDF document text
  • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/lovetijif/summer_escapes_pool_walmart.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b4a502cd-b927-4a2f-aa6e-df91f085f640/mizurajugexoxaluwivoxugo.pdfIn PDF document text
  • https://s3.amazonaws.com/xidulumexi/lagu_batak_soundtrack_film_toba_dreams.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2adc7cb1-4ac8-425d-a5a9-02eeea7e203b/natojumiroreluvu.pdfIn PDF document text
  • https://76bf09fe-c378-4d6f-baa9-beaf48595a8b.filesusr.com/ugd/61567a_20ed94765e0f4415833e06c92b8668a8.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/lixasifasi/siemens_built_in_coffee_machine_instruction_manual.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/24509ddc-f068-4e6e-94ec-8c55336a638f/bfw_publishers_ap_statistics_chapter_3_test.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5d2b213f-b499-4cfa-9015-df23866abbb0/59771941127.pdfIn PDF document text
  • https://s3.amazonaws.com/fowonaxul/free_powerpoint_infographic_templates.pdfIn PDF document text
  • https://e691ad07-92dc-45fa-af10-8929b4045ede.filesusr.com/ugd/87b9a8_dad3a711baae420a8d31f933aa3e396f.pdf?index=trueIn PDF document text
  • https://f635e5d9-31b1-4f19-b758-7a623be10181.filesusr.com/ugd/6cf0f5_2aa07632794e4927ab6ed5321aaa2e34.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • https://savannah.gnu.org/projects/freefont/In PDF document text
  • http://www.gnu.org/licenses/In PDF document text
  • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.