Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://midufefew.ru/award?keyword=big+data+analytics+applications+pdf PDF link annotation

  • http://lavka-karamel.ru/704115282952xpx9.pdfIn PDF document text
  • http://axecheat9.xyz/capacity_market_auction_guidelines_2019yy1ge.pdfIn PDF document text
  • http://larts.digital/botikikasawonulogudu6chmw.pdfIn PDF document text
  • http://telemprom.xyz/704502812728tvqi.pdfIn PDF document text
  • http://christmas-gift.ru/satuwipawikusudidukerereg1fan.pdfIn PDF document text
  • http://form-copyrightservices.com/how_to_find_parkour_races_on_gta_5_ps4yof06.pdfIn PDF document text
  • http://copyrightshelpcenter.com/42580264735i2p9q.pdfIn PDF document text
  • http://vorecan.fun/68534888423dfe6n.pdfIn PDF document text
  • http://mignonette.space/31350705488ssyk4.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://5053e88e-9e18-4719-890c-32a1cca0295d.filesusr.com/ugd/411503_9e379f7ef3c74a0593a53559ef0283ac.pdf?index=trueIn PDF document text
  • http://xegiseko.epizy.com/alicia_keys_no_one_audiomack.pdfIn PDF document text
  • http://fobexegedun.epizy.com/fourth_grade_worksheets_reading_comprehension.pdfIn PDF document text
  • https://d21da297-2d1c-4020-882f-059d99c29dc9.filesusr.com/ugd/3724a2_a2e5fb44431e45c395da977d238b4140.pdf?index=trueIn PDF document text
  • http://koraxirimaxodet.epizy.com/tell_me_about_yourself_sample_answers_dating.pdfIn PDF document text
  • http://katudajug.epizy.com/neretaketiletupizamib.pdfIn PDF document text
  • https://1c8fadd7-09eb-4d2b-9d42-8e747ba5ce52.filesusr.com/ugd/60625b_cf1bd352d3934bf698a05af7bde63f03.pdf?index=trueIn PDF document text
  • https://0633afab-057d-4448-85e1-ac1a97571725.filesusr.com/ugd/66920c_76f260e92ed54b3782b3f7691a19c5cc.pdf?index=trueIn PDF document text
  • http://divojeniro.epizy.com/memabag.pdfIn PDF document text
  • https://584abdf6-e408-48d3-a53c-4313a8f82471.filesusr.com/ugd/18ee90_13118ae356a4444b990293ee023b517c.pdf?index=trueIn PDF document text
  • http://xumutopefar.rf.gd/civilization_vi_android_apk.pdfIn PDF document text
  • https://f733e552-90a1-4d1f-83ca-a6b36afcf31c.filesusr.com/ugd/38bf1f_6a67514e7ba64e82994ac55f281d0aa7.pdf?index=trueIn PDF document text
  • http://rutukoka.epizy.com/57974708256.pdfIn PDF document text
  • https://2c9641c8-5874-4869-9b94-f1378e60aa6b.filesusr.com/ugd/efc1f6_a280e31ecdb14523b08ff5817123bda2.pdf?index=trueIn PDF document text
  • https://76ed6b59-b034-43ac-b949-e1c08f76e3cb.filesusr.com/ugd/ee6100_4ab1b64db32646a0b0f5a5d618122f93.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.