Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://midufefew.ru/award?keyword=sindrome+adiposo+genital+pdf PDF link annotation

  • https://cdn.sqhk.co/zogameva/jhfidgg/smoking_weed_wallpaper_free_download.pdfIn PDF document text
  • https://cdn.sqhk.co/fazovivum/dijMgjM/carnival_cruise_cancellation_policy_hurricane.pdfIn PDF document text
  • https://cdn.sqhk.co/libibajuzumu/VwSodwP/32482441968.pdfIn PDF document text
  • https://cdn.sqhk.co/jidobimatu/Sjc6ppF/71521840817.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4403539/normal_600bf5b54fccb.pdfIn PDF document text
  • https://cdn.sqhk.co/parepejapoki/haheTI1/53368052544.pdfIn PDF document text
  • https://cdn.sqhk.co/rafopaluko/iexOrMu/you_are_god_alone_from_before_time_began.pdfIn PDF document text
  • http://mutodute.22web.org/codycross_under_the_sea_group_34_answers.pdfIn PDF document text
  • http://renijulemigato.iblogger.org/simpson_power_washer_3200_psi_reviews.pdfIn PDF document text
  • https://cdn.sqhk.co/zuxafopagad/gd0iiX0/gofekituridogonexajudumum.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4413109/normal_604a960c80580.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4463812/normal_603ab4f68cea1.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4469827/normal_600fd68ea99c6.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4376878/normal_6022c4f676ac2.pdfIn PDF document text
  • http://fewemika.66ghz.com/scantron_forms_for_sale_near_me.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://4ef57e19-9a2e-4e6f-a444-f6b59f982a39.filesusr.com/ugd/4c1554_33da8c8036fa417eb0d5fbafd3463a8f.pdf?index=trueIn PDF document text
  • https://8dac4d01-2cd1-45d2-8b5f-6005f802adc9.filesusr.com/ugd/1f96ce_db32aef801f64f0786db0e6eaf686c35.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/09a47b09-8144-4a87-a2cd-c462b24dba70/best_financial_modelling_course_in_delhi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0fe99c43-265c-4642-bf32-3d4a07925b72/69158491860.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/96701096-8aee-4aa5-8941-8caf126cbd98/what_are_the_methods_of_teaching_social_studies.pdfIn PDF document text
  • https://7404da97-7fcf-4d5f-9d5f-3f8644e6773a.filesusr.com/ugd/35f767_42fb34af5925473ba56f79daa09e622b.pdf?index=trueIn PDF document text
  • http://widokox.rf.gd/the_valley_of_horses.pdfIn PDF document text
  • https://edf6f6ec-8a93-4ac2-80af-f76282245ca6.filesusr.com/ugd/738632_85209a54cde6415eaf4c415d4791cceb.pdf?index=trueIn PDF document text
  • https://917ed8d3-8a9f-4c5c-a3ad-554e533308ad.filesusr.com/ugd/a4e402_0ce45b750569499789db238df18aa377.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/96ee9fce-a3f3-42aa-bd5e-70624854f3e8/soxerubelinadudatis.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7eada629-bb01-45ea-927e-ac1d48e830c6/dnd_5e_fighter_subclasses_homebrew.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.