Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://midufefew.ru/strik?utm_term=introduction+to+philosophy+classical+and+contemporary+readings+fifth+edition PDF link annotation

  • http://yozi.store/new_tamil_movies_2019_free_tamilrockersq5qku.pdfIn PDF document text
  • http://helpforteam.com/love_breakup_images_in_tamilbe57d.pdfIn PDF document text
  • https://molujeridinu.weebly.com/uploads/1/3/4/4/134400438/4558536.pdfIn PDF document text
  • http://belplitka.ru/kuta_software_infinite_algebra_1_combining_like_terms_worksheet_answersg7u8p.pdfIn PDF document text
  • https://jinobodusere.weebly.com/uploads/1/3/4/7/134722577/bojeganuga_tivimitagi_jezuru.pdfIn PDF document text
  • http://good-production11.site/61097064736i0i0e.pdfIn PDF document text
  • https://ditakusoboke.weebly.com/uploads/1/3/1/4/131437623/fa76f3ce9b3e.pdfIn PDF document text
  • http://lazotub.mywebcommunity.org/contoh_amdal.pdfIn PDF document text
  • http://xemizawufogutuf.scienceontheweb.net/how_to_clean_mr_coffee_maker_10_cup.pdfIn PDF document text
  • https://pixojewunut.weebly.com/uploads/1/3/2/6/132695451/2119169.pdfIn PDF document text
  • http://euroshopmn.space/31919556011quk8p.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/184edee8-6616-401a-a56d-1a31dcac6c4d/wizard_sewing_machine_models.pdfIn PDF document text
  • http://wolobugoxew.myartsonline.com/bridge_to_terabithia_play_script.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e332147b-30ef-4854-9f13-ad1142a389b7/how_to_disassemble_speed_queen_washing_machine.pdfIn PDF document text
  • https://s3.amazonaws.com/jazuravazaguz/63079489908.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1dc94e53-b9b9-455b-9734-2b38f5de5dba/21866108858.pdfIn PDF document text
  • http://wegamaluperetuj.atwebpages.com/55575153921.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cbe1cfb3-0e55-4c75-bde7-59771f670be2/the_girl_from_ipanema_astrud_gilberto_joo_gilberto_and_stan_getz_mp3.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/86e7ab08-f9ad-4a6d-b206-9be3a49948de/63218782439.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0c0f7c35-b50a-4119-b03c-29ad33281a4b/vivofit_jr_3.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/67d74d4c-9f33-4d70-af49-62e2eb012ab3/tri_tronics_classic_70_g3_transmitter.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/81902042-003a-4142-990d-4d89774b84b6/how_to_control_dc_motor_with_arduino_code.pdfIn PDF document text
  • https://s3.amazonaws.com/nijosinizo/brothers_in_arms_acoustic_tab.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0d0e9351-db2c-436c-93ce-218c79b7a58f/vizio_38-inch_2.0_channel_sound_bar_sb3820-c6.pdfIn PDF document text
  • https://s3.amazonaws.com/gedimuta/date_sheet_aiou_ma_education_2019.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4b5b7a94-3b5b-4107-bb7a-83b74ca2a4f3/why_do_smoke_detectors_go_off_intermittently.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.