Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://botokaw.ru/award?keyword=bsc+cs+1st+year+syllabus+2020+pdf PDF link annotation

  • http://xujilutobidiko.iblogger.org/chopin_nocturne_op_9_1_sheet_music.pdfIn PDF document text
  • http://gsmall.space/gif_als_live_wallpaper_iphonew7kf0.pdfIn PDF document text
  • http://menformula.xyz/talonario_de_rifa_em_excelaqlne.pdfIn PDF document text
  • http://hellesypakk.online/motorbike_driving_simulator_3d_apkfw2tq.pdfIn PDF document text
  • http://karaulovlife.site/rosekakulodimzoxky.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/8fb258a9-34cb-4199-b94a-962a90b785e7/77751729719.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ec98d790-baa1-48b7-9f43-111380a3c89b/how_to_change_apple_watch_bands_series_3.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b7120244-10f7-4f60-b31d-5f32b706809e/45791822542.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6657c15c-9c51-40c8-af5a-a5326d49d29b/how_to_pass_dmv_permit_test_va.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0b5906ad-c8e2-4832-8c9b-99b9a41f69b9/vewokova.pdfIn PDF document text
  • http://petefuzaz.epizy.com/1001_arabian_nights_stories_in_bengali.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/51d3a95c-6de9-4e2e-a130-65d2726565f0/my_sweet_audrina_film_streaming.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6c2f429c-5beb-4334-b7fb-584584aee581/80907772586.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/df4627f1-4ce7-440e-84c4-bb598d7e39a6/romeo_y_julieta_reserva_real_review.pdfIn PDF document text
  • http://kibisabekod.rf.gd/kizumefezibobefudu.pdfIn PDF document text
  • https://684917c6-b594-4497-9ea4-141105166a5b.filesusr.com/ugd/0dc9f5_a2d80a736d9b4941be0ae7fd4c1f3b85.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/ea7bab49-033e-4129-9b30-a3db02955c90/home_beauty_and_the_beast_sheet_music_free.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/315112bf-0152-4c10-acb1-0ed951fce1ba/fizavepamavasogupafox.pdfIn PDF document text
  • http://wunikuwikefa.epizy.com/batolugukaw.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b6e5ca8f-4740-47ba-bba6-50f5702f9f87/60123536026.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cd7e8414-30b4-48f1-8136-6b1f9c8b1c7b/find_google_maps_history.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d2005eb1-be8d-47cb-8dd9-65e1554e21d1/iron_man_infinity_gauntlet_crochet_pattern.pdfIn PDF document text
  • https://7915398d-c9c2-4241-abdb-40cf742e4b8d.filesusr.com/ugd/d4df0f_c6f528eed5454a17a75581fedef6b51d.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.