Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://xezojetit.ru/award?keyword=basher+sabertooth+manual+pdf PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4380536/normal_60547668e4d23.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4491969/normal_602c7b617ec64.pdfIn PDF document text
  • http://garanibukumom.scienceontheweb.net/50450160407.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4420430/normal_5fcd259cdc439.pdfIn PDF document text
  • http://nugowimabu.mywebcommunity.org/romeo_and_juliet_dire_straits_analyse.pdfIn PDF document text
  • http://luwogexejel.getenjoyment.net/96121764062.pdfIn PDF document text
  • http://mufutekuson.getenjoyment.net/hamlet_oxford_bookworms.pdfIn PDF document text
  • http://jalosus.mygamesonline.org/a_view_from_the_bridge_york_notes.pdfIn PDF document text
  • http://xedeporib.medianewsonline.com/65453999055.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/908b6b76-f56d-4c4f-9c6a-3760b1129610/ff14_stormblood_art_book.pdfIn PDF document text
  • https://2cc3dcad-61c1-4442-8662-ca5be7cd8672.filesusr.com/ugd/71b93f_097ba48b3e764c0ca2ea287f9f60c38f.pdf?index=trueIn PDF document text
  • https://8a833fea-7c9a-4d2e-a5a7-d3590f42a3e5.filesusr.com/ugd/9aab09_d2948ad10eb8411d87cf553c88f6f61d.pdf?index=trueIn PDF document text
  • https://9c33b4df-6f14-41ad-9e94-a3a23f7ed20d.filesusr.com/ugd/2a975f_f0acd58fa8a6419ca23a4bf0f9846d08.pdf?index=trueIn PDF document text
  • http://livirava.atwebpages.com/tanikedazogu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e1b7f529-d77c-484e-a642-4fcb2b5e4dc8/jakanaviwekaxiv.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/884852ec-abc9-4a45-9a77-6df6858218de/cuales_son_los_articulos_dela_constitucion_mexicana_mas_importantes.pdfIn PDF document text
  • https://0c17d2ad-06a2-4efd-9128-26148cac6670.filesusr.com/ugd/44320b_46d061ff376c44f8957d844bbf752b58.pdf?index=trueIn PDF document text
  • https://9764c975-acb6-4bd5-a3ff-b1f4624bc9bc.filesusr.com/ugd/5bcb7b_386a5a6173ec4cfe9db713a917ad6e4f.pdf?index=trueIn PDF document text
  • http://sujunutab.atwebpages.com/dulokamajosomapasevu.pdfIn PDF document text
  • http://bivojeda.atwebpages.com/tamil_alphabet_writing_practice.pdfIn PDF document text
  • https://bcbc83ff-a82b-4234-bf1d-c69e8cae54d5.filesusr.com/ugd/057c82_6c7fa926d40a4ba5aba571850586bf29.pdf?index=trueIn PDF document text
  • https://cabae152-0d18-4cc7-9545-8711a89e332e.filesusr.com/ugd/607e04_9fa94111b9b0482d9cb25212cae926dc.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/69c3ffaa-f45b-4d97-bdf3-41f4d0737799/gowutuxemunid.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5af70f56-8bfd-42e4-bd54-217d63918904/hp_laserjet_pro_400_m401n_print_configuration_page.pdfIn PDF document text
  • https://e192e36c-395d-4660-9df6-aa7aed00c30a.filesusr.com/ugd/3aee12_4a84edcf4a254499be62c526dc697bda.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.