Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://pelibifir.ru/wix?keyword=bill+nye+buoyancy+worksheet+answers+pdf PDF link annotation

  • http://lotukaguw.sportsontheweb.net/william_faulkner_last_novel_crossword.pdfIn PDF document text
  • https://cdn.sqhk.co/ravawiku/x8vOUje/67761469076.pdfIn PDF document text
  • https://cdn.sqhk.co/wotutovebo/jFji0Jn/zombs_royale_aimbot_no_download.pdfIn PDF document text
  • https://cdn.sqhk.co/zativojor/ijiyaja/homeschool_curriculum_reviews.pdfIn PDF document text
  • https://cdn.sqhk.co/wowasuperan/ijdFrhl/73582522627.pdfIn PDF document text
  • https://cdn.sqhk.co/moxoxitij/fhhihgf/apocalypse_cow_game.pdfIn PDF document text
  • http://zakosemej.mypressonline.com/birikevibopaxibusa.pdfIn PDF document text
  • http://vipadobotisituz.mygamesonline.org/mawanivemekiwezujomodo.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://ca30e0e0-ecf2-44ab-b6a2-fe26291458be.filesusr.com/ugd/34e21e_8f55eb5f70634894981940b7c667bbc3.pdf?index=trueIn PDF document text
  • https://5c2cca0d-3a4e-48b0-93bf-8ac6c0c026cb.filesusr.com/ugd/271e65_2c6c28381d8a45c790d067d6889f3dd0.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/xugigabitulu/computer_hardware_and_software_and_how_they_work_together_to_process_user_requests.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0b3f1505-c7d6-4e09-8edf-3a38ca0a7a6f/18975943608.pdfIn PDF document text
  • https://21c505bb-01ca-4817-a549-4ed1ebba5040.filesusr.com/ugd/7d7105_7b23c81d18ed4fc3ac47233115d4f957.pdf?index=trueIn PDF document text
  • https://ac65beef-1c88-4b01-a948-251493ed82f2.filesusr.com/ugd/09857b_1cd0a355c898466c94f48a5f514db2fa.pdf?index=trueIn PDF document text
  • https://827a6da4-a69c-4806-aaaa-db522494bc4d.filesusr.com/ugd/cb5916_dbe6288d86384f8d92d405f73bf510e5.pdf?index=trueIn PDF document text
  • https://e028ba52-6c86-493e-86b7-fecf7cd1c3eb.filesusr.com/ugd/bcb9fd_528b67f7498145e2b349d74756f22c34.pdf?index=trueIn PDF document text
  • https://3d7304b5-8527-495f-b913-615d6f357a43.filesusr.com/ugd/ef7486_55b3e32603324ca7898995cc2b8d107f.pdf?index=trueIn PDF document text
  • https://dbba0f06-1911-40f0-8c80-a2638c7f81cc.filesusr.com/ugd/b13fd1_57fbb37387cf4e3ebaf4f365dc2e00ba.pdf?index=trueIn PDF document text
  • https://348ddb29-83e1-4812-94a1-743b72ef9b42.filesusr.com/ugd/23b571_13ceb49c9266449091c9a8cbdf128523.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/1b0eb729-d44f-4118-ac37-2c4de72d8762/the_last_song_full_movie_with_english_subtitles_download.pdfIn PDF document text
  • https://s3.amazonaws.com/bivanud/19404038039.pdfIn PDF document text
  • https://29159626-56e2-4eb2-a8c1-eb081f451e44.filesusr.com/ugd/a58502_88fd3b7dd57145b6bf86a1f7c58b00ca.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/84624ce8-f34a-4483-b62a-a906bf24eb18/webazenipozotejexu.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.