Malicious PDF — malware analysis report

Heuristics 5

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jacksth.ru/award?keyword=cae+gold+plus+exam+maximiser+2020+pdf

  • http://xubajaw.iblogger.org/pijevaseme.pdf
  • http://dovukumalamiga.22web.org/88303605095.pdf
  • http://penageli.getenjoyment.net/the_american_scholar_ralph_waldo_emerson.pdf
  • http://rexuwoxaga.sportsontheweb.net/mother_goose_nursery_rhymes_book.pdf
  • http://www.ascendercorp.com/
  • http://www.ascendercorp.com/typedesigners.html
  • https://0ac950e2-707a-4e47-8bf4-daface0ea9db.filesusr.com/ugd/356f11_65327559594742809c7d2a400538b99a.pdf?index=true
  • https://s3.amazonaws.com/divexikav/25034649438.pdf
  • http://fakomufe.epizy.com/1397135381.pdf
  • https://s3.amazonaws.com/zufaxepixiguxax/illinois_appellate_court_first_district_case_information.pdf
  • https://a8a70d16-e3f0-4805-b115-4d8c62c40b57.filesusr.com/ugd/82e28d_bace04b91f0349eaba11f6c7cc53c1f7.pdf?index=true
  • https://s3.amazonaws.com/xenavuxa/48102520536.pdf
  • https://s3.amazonaws.com/dukavunivifa/bifunurosabufebizufiv.pdf
  • http://dijilupejiba.rf.gd/8524334546.pdf
  • http://lokemuwebofeg.rf.gd/43770944080.pdf
  • http://zitadufafasid.onlinewebshop.net/95878946745.pdf
  • https://f635e5d9-31b1-4f19-b758-7a623be10181.filesusr.com/ugd/6cf0f5_5d2a891c58754c559ea4c3c72546a47a.pdf?index=true
  • http://lesesopexapawu.rf.gd/82933766004.pdf
  • https://8c56b32b-3398-45d6-9c0b-b55146621f16.filesusr.com/ugd/6924eb_e69b09467eed4515ae0d41094ad7c8ad.pdf?index=true
  • https://s3.amazonaws.com/wutisigila/65804308899.pdf
  • https://451b78f8-089e-4d4d-bc4b-60abb621f7e6.filesusr.com/ugd/7ef0dc_a87c92072d984106b6d9322a68755b7f.pdf?index=true
  • https://0dd0cd87-80d3-4eb5-b9c6-73c43c3a6fca.filesusr.com/ugd/f0b6b3_8fa576be33de4abe98f4ed0d5ac696d7.pdf?index=true
  • https://eaae50f7-3b1c-4f1b-9b3c-e2a48377569d.filesusr.com/ugd/b96e41_8b1ce7093cb842fcace971b51275d8a5.pdf?index=true
  • https://42190e62-4dca-482d-a077-ae7b222d7779.filesusr.com/ugd/b91392_4541fd23b85249b69d6a1b98a7bc3bb6.pdf?index=true
  • http://xidalagep.myartsonline.com/21528598198.pdf
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • http://purl.org/dc/elements/1.1/
  • http://ns.adobe.com/pdf/1.3/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/rights/
  • http://scripts.sil.org/OFL

Open this report in the interactive analyzer, or submit your own file for analysis.