Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jottigo.ru/award?keyword=teaching+young+learners+english+pdf PDF link annotation

  • http://mebets.xyz/tavonosagobamonoresovagaxkh1n7.pdfIn PDF document text
  • http://carinsusa.info/spectrum_math_workbook_grade_8_free92cvz.pdfIn PDF document text
  • http://uscovidcharts.com/fufunorojatezumewexpifm1.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://315736c7-1030-4200-8d24-05c9f4951019.filesusr.com/ugd/d19ca0_99b0fe92fa1a4cd49c03c378228e37ee.pdf?index=trueIn PDF document text
  • https://cc46d2ba-e7cf-42f8-aa62-b015a0c17ef0.filesusr.com/ugd/d180c3_f7f7b472c88d4c599a8a4f182fd458dc.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/654a2da6-0bdc-4425-94f7-7ae4ce88f69a/75567694782.pdfIn PDF document text
  • https://84d51d8d-5932-465a-b044-5d36dace581c.filesusr.com/ugd/98e2de_53ad332ef5734d67af25a7d40aa726e9.pdf?index=trueIn PDF document text
  • https://7e8267f5-6380-480e-ad72-df526eaefc07.filesusr.com/ugd/cbe325_0ad2675d59404ee68325ea2f762e54e5.pdf?index=trueIn PDF document text
  • https://7fad2989-91b8-457c-89bc-9a0e7aeef19f.filesusr.com/ugd/b03ff3_42cf00e8a795434786ef9cd4f4c33b4f.pdf?index=trueIn PDF document text
  • https://5457524e-bace-410a-9ce7-c8d8bc0eedea.filesusr.com/ugd/f0ffd0_dd0f598e18e048e49c6576a7c6e6070e.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/wozowuledij/sample_api_documentation_template_word.pdfIn PDF document text
  • https://s3.amazonaws.com/divikufifir/74795182198.pdfIn PDF document text
  • https://s3.amazonaws.com/pizivurapab/magazine_online_read.pdfIn PDF document text
  • https://s3.amazonaws.com/lijulijowivaze/carabineros_de_chile_informacion_de_rutas.pdfIn PDF document text
  • https://507d1b22-ea03-4061-a262-f79425337ca2.filesusr.com/ugd/a374b9_3894cd90b46d4bc18f0670b5bfe39302.pdf?index=trueIn PDF document text
  • https://d6477b75-8e4d-4453-8bbc-a86a6009e57c.filesusr.com/ugd/261d41_ea2ff63716ba4a818b6adaada57858ac.pdf?index=trueIn PDF document text
  • https://2ac56fc1-f7ee-4366-9cb2-1681469c68ee.filesusr.com/ugd/b914b5_2a6148607b0d43a393ea304e4baadc7a.pdf?index=trueIn PDF document text
  • https://8d684a1e-4078-49cd-b336-05adf09473b6.filesusr.com/ugd/2b25e8_66a7ee85e569473498a4b17c7a16d8b6.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/makixibawumebol/access_google_drive_on_android_tv.pdfIn PDF document text
  • https://ac3db616-04cb-40f1-8357-c67041f5e20c.filesusr.com/ugd/eda9ba_58b7dcff086b4920bf5b1203aaf3e4cb.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/ddf25c87-3032-4b43-8d98-4f0c013832c5/mackie_mix8_review.pdfIn PDF document text
  • https://b5d51143-f34a-4a4f-9265-6917490cb775.filesusr.com/ugd/9f69bd_4b6d4fcc81cf4d36af8c39dda402f72f.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.