Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://maypoin.ru/123?utm_term=angular+8+material+form+example PDF link annotation

  • http://lologunaw.mygamesonline.org/mckay_building_construction_volume_1_free_download.pdfIn PDF document text
  • http://zhigina.ru/43853014913yjzaj.pdfIn PDF document text
  • https://cdn.sqhk.co/zurefaxenov/gNjd5jh/oconnors_public_house_rochester.pdfIn PDF document text
  • https://cdn.sqhk.co/loganidob/EliiNsJ/bloom_better_you.pdfIn PDF document text
  • http://lovemecompletely.com/far_from_the_tree_documentary_summaryjr2bn.pdfIn PDF document text
  • https://cdn.sqhk.co/pefisemise/b0mici8/photo_color_changer.pdfIn PDF document text
  • https://cdn.sqhk.co/mapiwoda/mXiahbg/ncc_c_certificate_exam_syllabus.pdfIn PDF document text
  • http://komaxinatobofe.medianewsonline.com/95121155402.pdfIn PDF document text
  • http://dragonflysagewellness.com/your_wish_meaning_in_bengali1xdyy.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://c06d174a-caca-4ab2-b5a0-4525cd3135d4.filesusr.com/ugd/856cea_96c285d80f4741bf904fbfa2d1198933.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/08997381-f88a-48c3-b2d9-3d8085ace90d/dan_simmons_hyperion.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/69c10fd0-053c-4030-9430-060b54539094/pikuxisugamonodikimijo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/00105532-b06d-4108-960e-2a8fd759591e/bubev.pdfIn PDF document text
  • https://1c92f6d8-19eb-429c-9239-1cf6be91372f.filesusr.com/ugd/cc1a03_f5b0546f4a9643de9506374920f78a70.pdf?index=trueIn PDF document text
  • https://9c43cb74-45e3-47de-9527-fda2e8336169.filesusr.com/ugd/af0aa9_6715198f8edc414b93c80f65ec728f10.pdf?index=trueIn PDF document text
  • https://e02212b7-c8ec-4bf5-ba3e-d68a1de675e0.filesusr.com/ugd/7f1d73_dd202fa655ad48d09e8738a2797e750c.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/78404c60-10ad-4d37-b405-75e40d1c2309/tenefinosunawiki.pdfIn PDF document text
  • https://8860adff-7f0b-4cf3-a358-cdd560dff136.filesusr.com/ugd/625844_2b9baf12c0b04eee9063ecbeaffa2ec6.pdf?index=trueIn PDF document text
  • https://9b704b87-3668-414c-a24e-b30400fe0e33.filesusr.com/ugd/51c472_cf1d8b25143046f7a29640c7890ff564.pdf?index=trueIn PDF document text
  • https://85ed388a-52e0-4e79-9737-9d4b769dda71.filesusr.com/ugd/bb10c5_8154002a38774bfdb98439cb60a36b45.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/18b2806e-e7a2-42e7-9f5a-bec8cbeea74c/sj4000_camera_manual.pdfIn PDF document text
  • https://413f70bc-0247-4a04-a3fc-eabb14e2b93f.filesusr.com/ugd/f18ee6_fd091416f81144a7ba1f15c778defae9.pdf?index=trueIn PDF document text
  • http://wutejaxevewef.myartsonline.com/jedexot.pdfIn PDF document text
  • https://3f054cde-0430-4828-89d0-5f77035cf230.filesusr.com/ugd/d93890_18363108000848218335baea30fe92e0.pdf?index=trueIn PDF document text
  • https://bb55feb6-a0c4-48ae-8f72-aea2c45912f8.filesusr.com/ugd/b9801a_cef44fb9758343778e49f77a1863f0a6.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.