Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://seumenha.ru/award?keyword=que+es+un+antipiretico+pdf PDF link annotation

  • https://static.s123-cdn-static.com/uploads/4409619/normal_5fc97a6b3b70f.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4417656/normal_60075b3c8af15.pdfIn PDF document text
  • https://ximavubakalik.weebly.com/uploads/1/3/0/7/130776508/9612652.pdfIn PDF document text
  • http://kipokefurur.mygamesonline.org/39968361267.pdfIn PDF document text
  • https://xofebigile.weebly.com/uploads/1/3/0/7/130739964/7906891.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4417414/normal_601a300dd493c.pdfIn PDF document text
  • https://koduxiwarutuj.weebly.com/uploads/1/3/2/7/132740502/dexata.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4423453/normal_60233f3c7e6da.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4381547/normal_5fd0da3d73355.pdfIn PDF document text
  • http://sevoxotedeki.medianewsonline.com/pretty_little_liars_book_4.pdfIn PDF document text
  • https://dudobafileziv.weebly.com/uploads/1/3/5/3/135331993/pesadol.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4462696/normal_5fc7a858411b7.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4485301/normal_6043b98f1455f.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4447460/normal_6009017a81c50.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4468836/normal_5fe833c48bacb.pdfIn PDF document text
  • http://doxalasi.mywebcommunity.org/how_to_test_if_someone_can_follow_instructions.pdfIn PDF document text
  • https://murasujudadalox.weebly.com/uploads/1/3/5/3/135338307/3342542.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4455876/normal_5fd79bae84f24.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://6d251753-49d0-4f5b-a278-10ed1cacc9d0.filesusr.com/ugd/5c139a_fa11610664cf4dd292e0b00af29be94c.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/1efb4ea1-a1f0-452c-be75-0aa857c95e6a/hoover_twin_tank_steam_mop_replacement_pads.pdfIn PDF document text
  • https://15319a82-8c66-4906-b3c2-464277991f2b.filesusr.com/ugd/070acf_3caf04e295af46ec98c142b67515660e.pdf?index=trueIn PDF document text
  • http://ziwemasux.myartsonline.com/76040891747.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2bd9fddf-c8fc-4e8d-bc0e-43f9938451d4/nwn_world_of_greyhawk_forum.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f570755b-4f73-41a8-8196-3469c0ae9716/the_river_cafe_nyc_menu.pdfIn PDF document text
  • https://fa53e508-d88d-41cb-897c-7a5b6f1bfcc3.filesusr.com/ugd/361045_44644bb4419b48f89eebc10e7567819a.pdf?index=trueIn PDF document text
  • https://c5e26362-acc3-4c40-9db4-ce0cbd355080.filesusr.com/ugd/681527_49fa7b8dcf444551bc935fdac7bc1221.pdf?index=trueIn PDF document text
  • https://f608bf75-187c-4b28-9621-af925c05c2b6.filesusr.com/ugd/05e3ad_57a995f258004a5cb6df0304bd1f0964.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/ebcdf7be-0369-4042-b139-e85a4f3e75ac/how_much_is_a_monthly_bus_pass_from_nj_to_nyc.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.