Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dafemum.ru/wix?keyword=understanding+the+bill+of+rights+worksheet PDF link annotation

  • http://pochta-24.cc/13829165497c6ps2.pdfIn PDF document text
  • http://meetchambre.xyz/vowadibatibadaxikevojaxislhxys.pdfIn PDF document text
  • http://lamenomapod.iblogger.org/puvanetem.pdfIn PDF document text
  • http://technodom11.com/netusyn35f.pdfIn PDF document text
  • http://trysoda.pro/manual_handling_risk_assessment_template6kqj9.pdfIn PDF document text
  • http://goldstein.capital/ian_hacking_the_social_construction_of_what_summarys4u1m.pdfIn PDF document text
  • http://dk-inc.xyz/moon_lovers_scarlet_heart_ep_17mrfqh.pdfIn PDF document text
  • http://crawlmqyu.space/what_is_a_sextant_used_to_measurelj5gg.pdfIn PDF document text
  • http://idealslimitaly-official.site/glock_19_gen_4_magwell_agency_armsecjxa.pdfIn PDF document text
  • http://trylait.club/what_is_art_integration_in_the_classroomaj4pz.pdfIn PDF document text
  • http://idem-peshkom.ru/are_there_any_bonuses_for_joining_the_army_reservesg3f9g.pdfIn PDF document text
  • http://best-store.club/photo_studio_programam93t9.pdfIn PDF document text
  • http://lady-bug.club/settings_for_fender_champion_100ozen8.pdfIn PDF document text
  • http://nextauto02.ru/beren_ile_luthien_filmmsdbt.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://99b08629-27b2-41dd-83a1-938dc2ca35bd.filesusr.com/ugd/067ecb_b4af0fe0a6364686b6d7d5f57c9b7249.pdf?index=trueIn PDF document text
  • https://692937ca-140d-46b9-9715-018e108c1018.filesusr.com/ugd/2540a5_010dfbedfb8e468fb905ee73cee2983d.pdf?index=trueIn PDF document text
  • https://042e50b4-45d0-4577-915a-c14d43ab21ad.filesusr.com/ugd/18f527_b797866b9d1c4738a74acc3f523342d7.pdf?index=trueIn PDF document text
  • https://69b3109a-7cce-4514-9193-d2106d9976ab.filesusr.com/ugd/3c2969_0c9682c1c2194bde91f015b0ef2da76a.pdf?index=trueIn PDF document text
  • https://ebc1add8-0b9d-418e-9e4a-1e287827e933.filesusr.com/ugd/ab63e3_a9639296eb3f4ccb948389b46316ddcf.pdf?index=trueIn PDF document text
  • https://27158da8-170d-48ca-a528-b8ced62fe517.filesusr.com/ugd/9fc8c3_472c53bfa7fc41359d145b517ada0626.pdf?index=trueIn PDF document text
  • https://e37fb4d6-fac4-4cb1-96d9-cce2dae532e5.filesusr.com/ugd/ed2751_a503551d25b344b0891bf49fbdb396fe.pdf?index=trueIn PDF document text
  • http://sujevulakaginig.rf.gd/93488197811.pdfIn PDF document text
  • http://fofifalog.rf.gd/tecnicas_e_instrumentos_de_recoleccion_de_datos_que_es.pdfIn PDF document text
  • http://delunax.rf.gd/99582408201.pdfIn PDF document text
  • https://4f7f339c-9ee9-4921-a7ad-794169edd555.filesusr.com/ugd/fea72b_5fa6239672ac4bb1b42376fce7061184.pdf?index=trueIn PDF document text
  • http://sopigovo.rf.gd/zigeloresizaroluganexewud.pdfIn PDF document text
  • https://49884795-3b66-401c-adaf-b59e999553af.filesusr.com/ugd/8bd6c9_cbc24fd128714dbf970f53d7b60b603b.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.