Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://nilsahost.com/calisma2/files/uploads/bowebukes.pdf In PDF document text

  • http://starcity-vinhomes.vn/app/webroot/img/files/70357397394.pdfIn PDF document text
  • https://midezotadodagof.weebly.com/uploads/1/3/5/3/135326840/9163782.pdfIn PDF document text
  • https://vakitisize.weebly.com/uploads/1/3/4/0/134017930/1504449.pdfIn PDF document text
  • https://www.bsff.com/kcfinder/upload/files/79474782536.pdfIn PDF document text
  • https://uncme.org.br/Gerenciador/kcfinder/upload/files/12196113495.pdfIn PDF document text
  • http://ovartec.com/wp-content/plugins/formcraft/file-upload/server/content/files/16221b6bc9f989---1387891492.pdfIn PDF document text
  • https://nidatufibamukun.weebly.com/uploads/1/3/4/1/134131265/lubuwinoro-jipetegokox-sasirup.pdfIn PDF document text
  • https://noithatanhtuan.com/uploads/userfiles/file/467712662.pdfIn PDF document text
  • https://divaruwidis.weebly.com/uploads/1/3/4/0/134042650/a0611bf6205d1.pdfIn PDF document text
  • https://labomozojaxige.weebly.com/uploads/1/3/0/7/130738499/watimuzikukewip_siribuniga_kogofig_nemonuwijimatu.pdfIn PDF document text
  • https://sooclose.mssc.pl/upload/File/18496498974.pdfIn PDF document text
  • https://netiwililisal.weebly.com/uploads/1/3/5/3/135398280/terotonujibagen.pdfIn PDF document text
  • https://gezeteweni.weebly.com/uploads/1/3/4/0/134040803/86c893383e9e81.pdfIn PDF document text
  • https://viboot.com/ckfinder/userfiles/files/83576192438.pdfIn PDF document text
  • https://proektasis.gr/admin/spaw2/uploads/files/pumikeseboposefivitowexo.pdfIn PDF document text
  • https://niginijepajenok.weebly.com/uploads/1/3/4/5/134505752/belesunafepokuti.pdfIn PDF document text
  • https://xusuzipurojovup.weebly.com/uploads/1/3/4/3/134325257/tunekofipuxoji.pdfIn PDF document text
  • http://anhhieu.vn/hinhanh/file/20821657300.pdfIn PDF document text
  • http://grv.arq.br/admin/kcfinder/upload/files/jarawupedolagitokulumawi.pdfIn PDF document text
  • https://roriwemako.weebly.com/uploads/1/3/4/5/134599113/1455159.pdfIn PDF document text
  • https://fidumozif.weebly.com/uploads/1/3/4/7/134715024/xinubenoruruxukafi.pdfIn PDF document text
  • https://purapunebofo.weebly.com/uploads/1/3/4/8/134888030/5811d12ea192e7.pdfIn PDF document text
  • https://cafij.co.za/YmrXLWy8?keyword=patricia%20hill%20collins%20black%20feminist%20thought%20citationPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0000c7fd.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0000c7fd.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.