Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://xezojetit.ru/wix?keyword=el+principe+temporada+2+capitulo+11+completo PDF link annotation

  • http://devlp.design/lakemubokegazewowudk.pdfIn PDF document text
  • http://okstore.info/wamesuwidiwinavibetakubixep9ez.pdfIn PDF document text
  • http://csxmoney.info/elementor_templates_not_loadings4tqu.pdfIn PDF document text
  • http://idealica-italiaofficial.site/that_70s_show_episode_list_and_descriptionc8gfe.pdfIn PDF document text
  • http://zodimasar.mypressonline.com/how_much_does_an_aircraft_mechanic_make_in_the_philippines.pdfIn PDF document text
  • http://lorakuze.sportsontheweb.net/25731389851.pdfIn PDF document text
  • http://lebuvowune.getenjoyment.net/are_all_witcher_books_good.pdfIn PDF document text
  • http://teksalon.xyz/xafepodilegazojilahc36j.pdfIn PDF document text
  • http://jusapp.club/holy_rosary_guide_in_latin1msya.pdfIn PDF document text
  • http://student-yurist.ru/252755395072hmj1.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://d1897088-ef6e-4b60-8303-910b4b551fc1.filesusr.com/ugd/4cfbbd_dce6332b41264c9792e82d1a4ad13d34.pdf?index=trueIn PDF document text
  • https://e114ad41-1367-46fe-a5fd-427bf640f69d.filesusr.com/ugd/a63c55_37fdb7d7f25b4ea2a480527aa5e4434d.pdf?index=trueIn PDF document text
  • https://3e021c9a-284a-4c54-9ba1-f6d43d4d2ba5.filesusr.com/ugd/a619af_457a6950c2154be18076329a647bb9ac.pdf?index=trueIn PDF document text
  • https://d6236f05-450e-4b96-9875-1783d83c708b.filesusr.com/ugd/912de2_8f2be1c93bb44a5d994db8f5f6c91293.pdf?index=trueIn PDF document text
  • http://suvalomimo.atwebpages.com/dusk_till_dawn_lyrics_translation_in_hindi.pdfIn PDF document text
  • https://0306adf0-382e-42f1-903d-71c3961c97f1.filesusr.com/ugd/7ff653_d67ade371d794317b96c50232fb51e83.pdf?index=trueIn PDF document text
  • https://5cbbff6b-7c47-4fbb-abda-9de5069fbc88.filesusr.com/ugd/1a89c8_b9a072292c4f4fbebbb90bb215a6ea9a.pdf?index=trueIn PDF document text
  • https://c4bedd8b-a3e9-4aa8-9751-a6fde4035b7e.filesusr.com/ugd/037f08_7ac83d04482e4751ac86c3ef0d38a2cb.pdf?index=trueIn PDF document text
  • https://662517ce-f374-4037-aebd-99b1dbe00103.filesusr.com/ugd/0c4177_185c36ae1f4f452287bce739a21947b4.pdf?index=trueIn PDF document text
  • https://297de083-771a-4730-a3b8-a2afe8c7d209.filesusr.com/ugd/47424f_3f02fe7c1dab47928d38b9778d62d51d.pdf?index=trueIn PDF document text
  • https://1e8c0764-4a0f-46ab-84a2-5f63a8a44928.filesusr.com/ugd/6a0acf_ba3606c0b0474ef0a2197b8756be75f3.pdf?index=trueIn PDF document text
  • https://8d67285a-e3c5-4820-bb1a-bb91ce1079a6.filesusr.com/ugd/d54300_0ccfe07e3b4646579ed60cceff04896d.pdf?index=trueIn PDF document text
  • http://donijexufenu.onlinewebshop.net/nemuxalezinekivodurako.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.