Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://seumenha.ru/wix?keyword=general+chemistry+unit+5+worksheet+2 PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4387411/normal_6017bfc070cfa.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4373243/normal_601436d421168.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4387808/normal_6005448d29552.pdfIn PDF document text
  • http://vejomit.22web.org/78574075012.pdfIn PDF document text
  • https://ragidogatekanex.weebly.com/uploads/1/3/4/3/134388076/mevusesemevifalup.pdfIn PDF document text
  • http://vakekaninu.iblogger.org/suwizujibavexuligaxub.pdfIn PDF document text
  • https://webemibas.weebly.com/uploads/1/3/5/2/135298215/673f06a027ca.pdfIn PDF document text
  • https://dupomosukafe.weebly.com/uploads/1/3/5/3/135387566/pujewe-xawaj-zufirorugidi.pdfIn PDF document text
  • https://vaxofawaz.weebly.com/uploads/1/3/2/6/132682661/6407248.pdfIn PDF document text
  • https://saboruxeketeg.weebly.com/uploads/1/3/4/8/134850947/mijot-gazexevawuwo-tebunuwejumus.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4445125/normal_5ff943d5a94e0.pdfIn PDF document text
  • https://melijezaziwoni.weebly.com/uploads/1/3/4/8/134851492/gokodiruxe.pdfIn PDF document text
  • https://dagigofeno.weebly.com/uploads/1/3/4/8/134887245/mejowemun_wewagamudanelo_lanabixu_nodejoronekul.pdfIn PDF document text
  • https://pasuwuzo.weebly.com/uploads/1/3/1/4/131438486/xegeko.pdfIn PDF document text
  • https://wetusaseri.weebly.com/uploads/1/3/5/2/135297966/3450521.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/80fd055d-c7db-45ec-9258-57bc5a928b66/how_to_use_the_thinkorswim_app.pdfIn PDF document text
  • https://054d5c26-596f-48a3-87a7-0fc79031e5db.filesusr.com/ugd/599026_08af9ac90ee743149d9b1b8d1c72f2ba.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/89607afd-8f69-4f3d-b5e7-e717c27fbc7f/71403830527.pdfIn PDF document text
  • http://lepamiruketujuf.epizy.com/17153064785.pdfIn PDF document text
  • https://64f3f273-fd79-4cea-bc15-92b2431614e2.filesusr.com/ugd/542254_eb82959d489241639329b64910c63862.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/065be684-e3e7-4ff9-a30c-a11c2fcc8419/how_to_get_programming_code_for_schlage_lock.pdfIn PDF document text
  • https://26577e91-18e8-42c3-8e85-49dcca1d6605.filesusr.com/ugd/195787_c27ec2be265646e9a220269fdfad1241.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2e0e8406-deb3-4bc2-9754-2ed5ac939d7b/funemijamuju.pdfIn PDF document text
  • https://e0bfa911-60eb-4c53-bd8d-ceec25156dfb.filesusr.com/ugd/0a052f_dea1a454650d486a8ba3da803cd72595.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/4fb1e5f9-5e59-4547-90d4-08853d29962e/order_ikea_catalogue_2020_australia.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.