Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://botokaw.ru/award?keyword=application+form+for+nsfas+2020+pdf PDF link annotation

  • https://cdn.sqhk.co/dabozijide/jghhjnv/sky_map_free_app_iphone.pdfIn PDF document text
  • http://xsale.trade/cae_test_1ikmz0.pdfIn PDF document text
  • http://muldwych.com/duxigikamafutejit7uifu.pdfIn PDF document text
  • https://cdn.sqhk.co/lokalofobox/icFVgcg/17020470953.pdfIn PDF document text
  • https://cdn.sqhk.co/wufotubi/ghzheSt/tap_titans_2_artifacts_tier_list_2018.pdfIn PDF document text
  • https://cdn.sqhk.co/kelopifagisu/PggqPjc/rigewiturosenozuzil.pdfIn PDF document text
  • http://naturka.space/bevedi6tlyc.pdfIn PDF document text
  • https://cdn.sqhk.co/tamurikubol/h7wS7je/auto_key_presser_free_for_roblox.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/c3f57541-2541-44b3-a1cd-363c618f091e/easy_to_draw_caricatures_step_by_step.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a14e3ff0-ef14-47f1-ab2c-e091ad1d8c0e/ipad_mini_4_price_philippines_128gb.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5fe6a632-2317-4874-99d9-c233527dc04c/vekoxe.pdfIn PDF document text
  • https://s3.amazonaws.com/tisegovofu/48503573850.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ef7883c1-0107-494e-99ca-9ec858b2dac4/vuvojewiwenekorofuru.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5e336342-d3c8-4768-93c1-34751fadd6bd/what_does_it_mean_to_be_peace_sign.pdfIn PDF document text
  • https://s3.amazonaws.com/fizup/ibn_kaseer_tafseer_in_english.pdfIn PDF document text
  • https://3f740848-0e57-4b51-8596-564812021bec.filesusr.com/ugd/cbe17c_855c9c7a7ce445298224bcde0dd878d0.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/zidenigad/10356422385.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7c4d5b4d-9fff-4ccb-96ff-9d5cb2e5842e/97811996414.pdfIn PDF document text
  • https://03df74f7-894d-4c84-999e-da2b33eb06f5.filesusr.com/ugd/4c7733_add246aa436d44c1b79140a0c6af02fd.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/gidibesuxi/dezowutuj.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/df3c388b-7bde-4e2b-b66d-5d65dc9ca937/kizuzilojivi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9190d2d5-dffb-420b-a415-69a5bcb41684/bunker_hill_security_camera_manual_62367.pdfIn PDF document text
  • https://a581e706-3bf6-41fb-8978-ad4d4077590d.filesusr.com/ugd/afbe6b_c5cddf5ce1b549b1b3dedcc0df1b9c93.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/d4331d01-1925-47cd-87ca-482b0219913f/16218941554.pdfIn PDF document text
  • https://2ac8321c-28d8-41c8-ac7a-99137a6fe030.filesusr.com/ugd/157ee0_d3096fed73214799a5a897124f231e1d.pdf?index=trueIn PDF document text
  • https://7f2467c6-0d80-4e38-8df7-27624e0b9669.filesusr.com/ugd/e19533_d6925df967974a97bc5dc912de066551.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.