Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://botokaw.ru/award?keyword=causes+of+ovarian+cancer+pdf PDF link annotation

  • https://mojipodo.weebly.com/uploads/1/3/4/5/134592530/voxegin.pdfIn PDF document text
  • https://cdn.sqhk.co/kigimole/ihtghjb/lonadowaberewarubiwa.pdfIn PDF document text
  • https://kusudojisopev.weebly.com/uploads/1/3/4/7/134774064/ccb1069588c7bf2.pdfIn PDF document text
  • https://zizobisorodevu.weebly.com/uploads/1/3/5/9/135964877/jokuwewu.pdfIn PDF document text
  • https://cdn.sqhk.co/pubabolab/mKgh2jg/animal_sounds_app_apk.pdfIn PDF document text
  • https://cdn.sqhk.co/tobipamu/fWhghh9/38595837725.pdfIn PDF document text
  • https://cdn.sqhk.co/tamejenonisi/Ve8iiX0/bubble_pop_electric_remix.pdfIn PDF document text
  • https://lelunoforonu.weebly.com/uploads/1/3/1/6/131606056/mizibikog-faxinofasojetiw-tinuwewigop-limitubome.pdfIn PDF document text
  • https://tivofexogi.weebly.com/uploads/1/3/1/3/131398075/4478354.pdfIn PDF document text
  • http://nutigunejome.22web.org/37223327026.pdfIn PDF document text
  • https://cdn.sqhk.co/viforoge/hiw3FQ5/billie_eilish_instagram_story_october_2020.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/72758723-8147-4086-81c6-07d79c1de366/41546064032.pdfIn PDF document text
  • http://laxizal.epizy.com/16566449564.pdfIn PDF document text
  • https://5ce19dfa-329f-495d-88d1-e1e7834d9072.filesusr.com/ugd/d902bb_6ce884f2dd72429ea835e5cedabb6cdf.pdf?index=trueIn PDF document text
  • https://e055bcc9-c4f1-4c6c-8dcb-0912bf54750f.filesusr.com/ugd/b4a829_516f9388dee4498e876f2017ead47de2.pdf?index=trueIn PDF document text
  • https://76c87692-cca9-4651-be8e-de6412dad411.filesusr.com/ugd/fdad67_3ef73dcfb4b640c1a623df118b9423f6.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/ab521111-107c-4d8a-b505-046382151fbe/difolijoridof.pdfIn PDF document text
  • https://44dd6259-7513-41c7-b2f1-b2b1fc385d2e.filesusr.com/ugd/63022f_2470a1a2823048a4a20285eb666c66f0.pdf?index=trueIn PDF document text
  • https://7e70056c-c2aa-4e53-98c5-50750123c107.filesusr.com/ugd/f8ae5d_4a0c8c16f01242f98eae6ac1a8f50229.pdf?index=trueIn PDF document text
  • https://b54663a3-ff9d-4122-b75c-69b71428c9b0.filesusr.com/ugd/cfa91a_d71e2e7b42fb433e90ec82500ed9749e.pdf?index=trueIn PDF document text
  • http://tetutima.rf.gd/abraham_maslow_theory_of_management.pdfIn PDF document text
  • https://7fd92c66-d3af-485c-b7a9-31529ddfb1b5.filesusr.com/ugd/997d0f_aa154629344642c4a9261f6c736db31c.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/fa2106c8-4ce9-4843-8569-0e9caec6285b/93614635577.pdfIn PDF document text
  • https://7e079b21-6cfc-4bbc-a8af-001f4930a7f2.filesusr.com/ugd/f66805_edfbe502b50b4af1bc4df253fc93e3b5.pdf?index=trueIn PDF document text
  • http://pekesapawej.epizy.com/angina_de_pecho_complicaciones.pdfIn PDF document text
  • http://koxogulu.rf.gd/85114910344.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.