Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://midufefew.ru/strik?utm_term=how+to+connect+to+harvard+wifi PDF link annotation

  • http://lexanizisujufum.66ghz.com/60489088634.pdfIn PDF document text
  • http://legejuwarowu.22web.org/80578934645.pdfIn PDF document text
  • https://cdn.sqhk.co/kalusoxat/bBO1kHt/nikumitudibelopetininolar.pdfIn PDF document text
  • https://cdn.sqhk.co/semubedogi/hbgchy2/82076953264.pdfIn PDF document text
  • http://refoxipixob.iblogger.org/makkar_ielts_speaking_free_download_may_to_august_2020.pdfIn PDF document text
  • https://cdn.sqhk.co/gaxudofexal/TFNgchi/66914751551.pdfIn PDF document text
  • http://tujozavido.66ghz.com/fieldglass_timesheet_instructions.pdfIn PDF document text
  • https://cdn.sqhk.co/furugilenu/thj6gId/xolumodisujonotagon.pdfIn PDF document text
  • https://cdn.sqhk.co/moviferu/jihjfDH/lawnchair_v2_vs_nova_launcher.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://e148473a-3d1a-46f8-b788-fbc1f5af68d4.filesusr.com/ugd/e1e70b_9c9f068438ad4002bac5520c8c30c9e7.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/baxunaf/xebolufisejaka.pdfIn PDF document text
  • https://329f26c8-0235-4118-8622-173d264d9cf1.filesusr.com/ugd/221f3a_95d8d8e010a34a3cb2d84de1874d3d24.pdf?index=trueIn PDF document text
  • https://171e2b11-24ea-4535-acac-f971ec821c4b.filesusr.com/ugd/a07927_23332406b813484a989ec4c3a143cc54.pdf?index=trueIn PDF document text
  • http://xowofalofuzuxis.epizy.com/windows_2020_active_directory_interview_questions_and_answers.pdfIn PDF document text
  • https://s3.amazonaws.com/perurulexi/how_to_reset_atem_television_studio.pdfIn PDF document text
  • https://1e438cd7-6f3b-42ac-a97b-d13a75fa135b.filesusr.com/ugd/0c268c_d09f7dcf359240e98cd8592b550378c7.pdf?index=trueIn PDF document text
  • http://dovanudoku.rf.gd/53609225285.pdfIn PDF document text
  • https://0ffdd24b-620b-4f4d-94ef-a39da1ca20bd.filesusr.com/ugd/853ce2_1cc7bba221684d7aa47819a0c1467ef2.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/dukexajuj/vobezusibasagijaxutujuwox.pdfIn PDF document text
  • http://guberiwexoza.rf.gd/90858617838.pdfIn PDF document text
  • https://a97cc435-ef8e-4ffb-8544-4b9c0bda5a6e.filesusr.com/ugd/7ab440_72c33450ca8d4b0d8a6990cf3385cd59.pdf?index=trueIn PDF document text
  • https://73a1781f-5c9f-4c76-8a11-a8e8c44f336a.filesusr.com/ugd/d9f7b5_328671e8474a44a9a8a7bcaf21e2226e.pdf?index=trueIn PDF document text
  • https://cb0920a4-0dfc-4587-8161-bd3bf883b043.filesusr.com/ugd/df391a_bada56ad87da4f29a671e7a13aaa95b3.pdf?index=trueIn PDF document text
  • http://runapapaxezupow.rf.gd/avast_cleanup_tool.pdfIn PDF document text
  • https://s3.amazonaws.com/gumagabu/post_coital_bleeding_guidelines.pdfIn PDF document text
  • https://165b0ab0-89c3-4517-b88f-e2bd0c55d975.filesusr.com/ugd/97b555_4d97141cf6e141d1ae68bcaa46f47eb0.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.