Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://resalured.ru/award?keyword=laporan+pendahuluan+unstable+angina+pdf PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4379970/normal_6049553bbfb37.pdfIn PDF document text
  • https://jewelilug.weebly.com/uploads/1/3/4/3/134331877/99314.pdfIn PDF document text
  • https://zidovularirijap.weebly.com/uploads/1/3/4/7/134718784/1948009.pdfIn PDF document text
  • https://fabofosozani.weebly.com/uploads/1/3/4/8/134870462/2792969.pdfIn PDF document text
  • https://likunemotiro.weebly.com/uploads/1/3/5/2/135299998/412a829.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4416504/normal_5fce0eff647a3.pdfIn PDF document text
  • https://xososikanezav.weebly.com/uploads/1/3/4/8/134892973/e2aab8c2d1cfaa.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4468871/normal_5fe73084a8b68.pdfIn PDF document text
  • https://nobewiga.weebly.com/uploads/1/3/5/3/135315034/tupuwovotane.pdfIn PDF document text
  • https://woxazalaxit.weebly.com/uploads/1/3/4/2/134235403/19398.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4421471/normal_5ffad8586fb54.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/09d6138a-0fe2-4643-ae6c-fa91b8bd3fa4/pavuxivadolovululiw.pdfIn PDF document text
  • https://cf4de027-7369-46c2-bf93-d69cabef2b5e.filesusr.com/ugd/868b90_ee71ef519aab4599a229c761b27a7808.pdf?index=trueIn PDF document text
  • https://1fc3e790-19e1-43b7-bae7-d09a953f51fe.filesusr.com/ugd/2c608b_f742a5f3fc2a460f8a4d783013762e43.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/81fd2ea3-c27a-488d-adf0-30085a62ddeb/lunirof.pdfIn PDF document text
  • https://af30af13-e0b7-4de0-aca7-7783c01eade2.filesusr.com/ugd/9757e7_178696597a0c462f96e2be3f8166bde8.pdf?index=trueIn PDF document text
  • https://eeebefec-a839-4a3a-9f85-40791d64ec9d.filesusr.com/ugd/4cd51e_e1cad2479f3a4daa9d1d5435f71c441b.pdf?index=trueIn PDF document text
  • https://7e073981-ad1c-4081-8dc0-76946ba36063.filesusr.com/ugd/c4f63d_250dff41161042b1a475edfe7e406f0f.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/cf1a94d6-2465-48b1-aa58-b9955b5b93ae/french_vocabulary_quiz_advanced.pdfIn PDF document text
  • https://40785fcd-1e5e-4316-9306-5db1d5795eae.filesusr.com/ugd/2f07a1_1a146dfea1464f7eba172ca2dff725dc.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/9f541053-2319-4274-9d6f-b28942ee54ae/what_is_computer_ki_definition.pdfIn PDF document text
  • https://48e5b1ff-25fb-49a4-826b-3ad3f3a15688.filesusr.com/ugd/0d632a_c1593da564d247458178f7f62aa51567.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2498b38a-622d-46c4-a9ef-803b29acd49a/how_to_add_page_in_wix_editor.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.