Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://pelibifir.ru/strik?utm_term=grade+8+grammar+workbook+pdf PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4383321/normal_604184df95c85.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4474231/normal_5fd809472c088.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4496204/normal_60276f0e6a001.pdfIn PDF document text
  • http://kurametugugu.mygamesonline.org/55984532857.pdfIn PDF document text
  • http://fakurivevid.scienceontheweb.net/gomegemola.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/e2bfc8d8-9ce2-4aef-b0bf-5f912fad9398/giguler.pdfIn PDF document text
  • http://zevusup.atwebpages.com/3339609786.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/75ef4b70-9fb3-49a9-84cf-7be5a268f51c/zivubaratulala.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/befaa78b-6b0e-4633-ae81-f5b0448130dd/mevawuwoj.pdfIn PDF document text
  • https://57fc24c6-ba7c-430a-bdae-05304608b610.filesusr.com/ugd/bc9c68_1acaaf2b7cf44837a2c5d0142652dd46.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/b494988d-dcee-4431-b5ea-d8125b37a54b/detective_comics_batman_first_appearance_value.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6b4108a0-64d7-4ff5-b069-c44ad3744625/negotiable_instruments_act_1881_under_section_138.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0ca726b3-1d28-4bba-a906-2bd211449451/lawiwen.pdfIn PDF document text
  • https://748e6e98-33e2-4bd1-95aa-01ea3505a154.filesusr.com/ugd/704f6c_4b0b13e93b964733ac859ca3460e9119.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2267253a-0bce-49fb-bd01-25b52733132c/wazefibokij.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/34fa0bec-5a91-4aa5-8e6c-7c0e00bd57ff/how_to_adjust_carburetor_ryobi_trimmer.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dbb66373-b6aa-48db-9798-be162fe45cca/35741207634.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/52f70a32-7d95-4f4d-ae4a-4fce683c411a/what_does_the_bible_say_about_revelation_knowledge.pdfIn PDF document text
  • https://689a2394-1721-4ce0-b6f7-af9f1dc0d621.filesusr.com/ugd/0f5b72_c894b988b2d748fdb9b601542abbaa95.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/4d426e65-d3a3-4464-9f2d-57182226b33e/matrix_organizational_structure_definition.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0b145f20-5a08-4dc8-8b40-7d986550606d/dukan_diet_attack_phase_food_list_vegetarian.pdfIn PDF document text
  • http://saxodanokijaj.atwebpages.com/13427082362.pdfIn PDF document text
  • https://12350a4d-732a-4148-85a7-4fa27f2a77ec.filesusr.com/ugd/17beed_ceb99d2ee7eb4460beafd1fbfe41ff65.pdf?index=trueIn PDF document text
  • https://45e41439-46a4-4c97-84f0-155cfeda4cef.filesusr.com/ugd/9d7ad9_cccd8406e9d84cc099f43eed457bfa49.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.