Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://xajibur.ru/strik?utm_term=how+to+set+up+a+moultrie+mobile+camera PDF link annotation

  • http://kelnoteres.xyz/how_to_contact_dish_customer_servicel0faa.pdfIn PDF document text
  • http://reduslim-siteofficial.site/jikinumerexufugelunibife2pinf.pdfIn PDF document text
  • http://ing-cliente.com/35516623063hdz0s.pdfIn PDF document text
  • https://fekoguto.weebly.com/uploads/1/3/4/4/134491689/mimesusa.pdfIn PDF document text
  • http://xotujezal.mypressonline.com/vande_mataram_song_lyrics_in_english.pdfIn PDF document text
  • https://bipipabogudas.weebly.com/uploads/1/3/1/1/131164499/xofanafibizu.pdfIn PDF document text
  • http://secureappeal.com/lavish_photo_studio_los_angeles6juvj.pdfIn PDF document text
  • http://xivazokib.medianewsonline.com/38422009888.pdfIn PDF document text
  • http://good-production20.site/corbin_russwin_cl3500_templategcure.pdfIn PDF document text
  • https://murasujudadalox.weebly.com/uploads/1/3/5/3/135338307/tewujuro.pdfIn PDF document text
  • https://vakitepodedobi.weebly.com/uploads/1/3/5/9/135963574/fezunovigajir.pdfIn PDF document text
  • https://nepokotivo.weebly.com/uploads/1/3/2/8/132814168/677b4d535.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/26acd523-1d6b-4aa8-acd2-b0d607b0febe/73451972558.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a5bab455-359b-4f99-896a-99c75ba3df91/algebra_ii_workbook.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/55d02296-3d8a-4116-8a70-5fb1f052fb29/thank_you_lord_god_for_everything_quotes.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3128dda5-be45-4fe1-b736-9569c4e440d1/what_is_darwinian_evolutionary_theory.pdfIn PDF document text
  • https://c5e26362-acc3-4c40-9db4-ce0cbd355080.filesusr.com/ugd/681527_89c78414831f497fa50a87d60c8a4d85.pdf?index=trueIn PDF document text
  • https://cee4a208-09ac-40e0-983f-4c2cc776acbe.filesusr.com/ugd/5ed537_bcf8b6fab4c7428ea026be7ee7cf7a59.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/18b56771-ad72-4137-a27a-e84472a546ed/agatha_christie_book_club.pdfIn PDF document text
  • https://5ac9d038-517d-4536-97f6-676423289421.filesusr.com/ugd/b444d4_8349cd1c36bd49818c438e0e449d3cca.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/052bb351-f67d-4119-b7d6-7dd709710fb6/a_time_to_kill_movie_true_story.pdfIn PDF document text
  • https://6b2f37ea-3696-4b87-858b-663c379f6f6f.filesusr.com/ugd/16879a_2ede083ae0604b449824580214024760.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/81a67b00-2881-47d9-af80-8b3a0ac74b1d/how_to_run_a_successful_meeting_in_half_the_time.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e1549a7a-b4c6-4df3-85be-9085b096233f/porusosu.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.