Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://golowaki.ru/award?keyword=reformasi+pendidikan+islam+di+indonesia+pdf PDF link annotation

  • http://fimokeroda.22web.org/what_questions_are_asked_in_a_dolls_house.pdfIn PDF document text
  • https://cdn.sqhk.co/dakagugi/bMjfgjD/20558662830.pdfIn PDF document text
  • https://cdn.sqhk.co/kikepedu/iahhghf/missing_411_map_wisconsin.pdfIn PDF document text
  • https://cdn.sqhk.co/tuwebobit/2jfkjA3/birthday_cake_with_name_and_photo_online_editor.pdfIn PDF document text
  • http://dipitada.iblogger.org/budgeting_loan_form.pdfIn PDF document text
  • https://cdn.sqhk.co/kapokosop/gcxjmYE/update_ios_12_ipad_mini_2.pdfIn PDF document text
  • http://sowoxapexemex.sportsontheweb.net/ms_excel_assignments_for_practice.pdfIn PDF document text
  • https://cdn.sqhk.co/fakobijo/1gb5gfL/turbo_drift_3d_car_racing_game_mod_apk.pdfIn PDF document text
  • https://cdn.sqhk.co/zetuzire/csu2ggc/download_lathe_simulator_mod_apk_indonesia.pdfIn PDF document text
  • https://cdn.sqhk.co/letaziseb/YRj0jbX/wezojixarorepowedepidudav.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.opentle.orgIn PDF document text
  • http://zevatilak.epizy.com/acute_glomerulonephritis.pdfIn PDF document text
  • https://0ed7c29b-d5f2-4290-8b47-add6aa38300d.filesusr.com/ugd/32a223_188b10ca41b24d9dae0b43c15da9b24c.pdf?index=trueIn PDF document text
  • https://85d2c5a2-fc31-4f76-86b4-4ebe2abe2bf4.filesusr.com/ugd/a8cc01_19749535b0ba4097b4ff43c710dd5123.pdf?index=trueIn PDF document text
  • https://4eb3a9b5-ca6a-4b2a-896e-878abc754f3b.filesusr.com/ugd/f1ab86_a60dd5788ba7459792f588fcce0924c5.pdf?index=trueIn PDF document text
  • https://24d1f61b-f5c5-4d2f-8180-62589f44e8d8.filesusr.com/ugd/eed56f_084a3450ba68445caab273f9c28a9086.pdf?index=trueIn PDF document text
  • https://03386fec-e341-46be-bf9f-2f2bd19f9bfe.filesusr.com/ugd/bf57b5_1db09ee0b6334104b64d0683d24e9700.pdf?index=trueIn PDF document text
  • https://95e354e6-8561-4e52-807b-deb85f3b5fdd.filesusr.com/ugd/ca9b0a_6062ab37de4741669fd156d9e55372d7.pdf?index=trueIn PDF document text
  • http://novogizeboje.myartsonline.com/dunkin_donuts_multigrain_bagel_recipe.pdfIn PDF document text
  • https://6b52f5a6-db44-4d3e-8337-ab33c729cb13.filesusr.com/ugd/f4de5e_8eaed008182c4e3a87dbfe837df9f4d3.pdf?index=trueIn PDF document text
  • http://votofeki.epizy.com/gomomi.pdfIn PDF document text
  • https://abbf68a8-5b21-4996-91be-11266bd273ed.filesusr.com/ugd/9374a7_68f71cd6d8954735b0e4b50cc5a7823f.pdf?index=trueIn PDF document text
  • https://79e8b926-cc52-4cef-90ae-68e3990d752e.filesusr.com/ugd/694d5d_aeab43aa239e4719a7900dff98f929af.pdf?index=trueIn PDF document text
  • https://5c3e38fa-bf2d-4cda-bfdc-19e9a39f2227.filesusr.com/ugd/b3ada4_95c9ae16d1404beb8057267929ec4af0.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.