Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://xajibur.ru/wix?keyword=crossword+quiz+daily+january+2+2020 PDF link annotation

  • http://mufadapi.22web.org/notutiboxikomidonalaxagux.pdfIn PDF document text
  • http://zesenadozefut.sportsontheweb.net/pagaf.pdfIn PDF document text
  • http://fakixigulidol.mywebcommunity.org/tomoxigodabuwuradatesav.pdfIn PDF document text
  • http://vumajuzatijerak.getenjoyment.net/hamilton_beach_soft_serve_ice_cream_maker_recipes.pdfIn PDF document text
  • http://zekaxezixil.medianewsonline.com/el_conde_lucanor_vicens_vives_clasicos_adaptados_gratis.pdfIn PDF document text
  • http://suvoramitasowiv.22web.org/31510582393.pdfIn PDF document text
  • http://vatidenow.medianewsonline.com/99112672740.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/4e775877-37e8-4245-8de8-2dd60327f3ba/14892608153.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/eaf56c8e-36e0-40cf-a188-e302c1663e71/48529604935.pdfIn PDF document text
  • http://texazelezawo.rf.gd/24344588686.pdfIn PDF document text
  • http://doriponesarom.myartsonline.com/hawk_roll_tackling_drills.pdfIn PDF document text
  • https://ddb1515c-011f-4d6c-9a6c-b305a2039a85.filesusr.com/ugd/477ac5_120aec2da3af4dcd93c87910e8ef7f8d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/0e367e4f-b4c6-48ce-8de6-7d714c1a4e6e/how_to_make_a_mole_in_chemistry.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cb6ed3fa-ed33-45b2-a7a4-c3e87ba324e8/what_are_recreational_activity.pdfIn PDF document text
  • http://javasuk.epizy.com/powerpoint_roadmap_templates_free.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f6bb3f39-a790-4d6e-8d8c-01f702c46675/can_anxiety_make_hallucinations.pdfIn PDF document text
  • https://a519209a-2b0a-481f-9fe9-460c873bdc80.filesusr.com/ugd/270e53_9be78f92609147b2a8534a8b0cc45ce8.pdf?index=trueIn PDF document text
  • https://9f53eded-325d-4e02-8430-7c09bd872488.filesusr.com/ugd/e04405_72aa0fe6df1a498685237451948d899f.pdf?index=trueIn PDF document text
  • http://kewevagisugimuw.onlinewebshop.net/how_to_reset_a_zte_tracfone.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/186bcc18-f47f-49fe-bfa7-ef4b5fadf6fb/who_was_the_us_constitution_ratified_by.pdfIn PDF document text
  • http://sujevulakaginig.rf.gd/zufomigupoputule.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9edb2c5e-be34-4f46-a0d3-5b61b910d29e/westinghouse_tv_remote_rmt-24_not_working.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/451f7963-d395-4849-b4bf-b6a768f197f0/navy_civilian_employees_pay_scale.pdfIn PDF document text
  • https://b89c0965-50b5-483f-b67e-52f573158f4f.filesusr.com/ugd/1e222e_5d946a4b90a84aa6a01458da5e4ed192.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.