Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://soxebez.ru/wix?keyword=pharma+qc+interview+questions+and+answers+pdf PDF link annotation

  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://eaae50f7-3b1c-4f1b-9b3c-e2a48377569d.filesusr.com/ugd/b96e41_e22b73cbb9de48309377d31383705672.pdf?index=trueIn PDF document text
  • https://85ed388a-52e0-4e79-9737-9d4b769dda71.filesusr.com/ugd/bb10c5_eeeb7d129052421fada282ec3115a2c8.pdf?index=trueIn PDF document text
  • https://569e8712-2873-4b93-a654-ea71b6b809e3.filesusr.com/ugd/345929_5d92cfaffd0b4e4da36c1debc41eb118.pdf?index=trueIn PDF document text
  • https://ebc1add8-0b9d-418e-9e4a-1e287827e933.filesusr.com/ugd/ab63e3_30be803dfba24b6fb27569e472c3e215.pdf?index=trueIn PDF document text
  • https://161abad2-7de2-49bb-9904-d6e2a620a662.filesusr.com/ugd/2eec94_67312cbcd71c4e11a0da4948e4d31215.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2e924b10-727e-402a-98f4-0be3d88ea244/jeep_grand_cherokee_diesel_problems_2014.pdfIn PDF document text
  • https://5ec50ee2-6c76-415b-b731-82d7de26534b.filesusr.com/ugd/826e74_ddfcbdd49dc7438a9591d5f38172c068.pdf?index=trueIn PDF document text
  • https://1b65b899-5fad-42bd-af9e-a3fb1d6a4c80.filesusr.com/ugd/a2ebd8_8263126d5f994db1adfccc7adfa2f65e.pdf?index=trueIn PDF document text
  • https://2ed821ec-8078-4e74-b11b-c5cec6a88262.filesusr.com/ugd/65e777_26e9350e43cc4a279cfeccae7a07515e.pdf?index=trueIn PDF document text
  • https://77bc4ea4-de20-41c0-a463-a5315db628d9.filesusr.com/ugd/2c69e3_7a97df33fdb148e48cb4a82174ee0d5c.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/035a3659-61b9-4c0e-be6e-88ab9ac7d3b4/dewalt_compound_miter_saw_dust_collection.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ae6692ad-47c5-4980-9fc0-c6afb53984f0/zegonez.pdfIn PDF document text
  • https://c01188fd-d8af-4b86-846b-090f7ecd58d8.filesusr.com/ugd/9058e5_18ede7ec90d4404a9c73115ba811a698.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/xisefowu/99160626569.pdfIn PDF document text
  • https://s3.amazonaws.com/nalifij/31555792322.pdfIn PDF document text
  • https://2a983b51-2e13-4971-8c1f-a5bca3ab4353.filesusr.com/ugd/e1a791_48a4b0b0fa2d48bb91d0d1ecec51d0eb.pdf?index=trueIn PDF document text
  • https://21e323bd-7fdd-46e9-a6c7-4880e76d7610.filesusr.com/ugd/0a51c1_abbd0e42d1f2419081be93ab367fd049.pdf?index=trueIn PDF document text
  • https://a21f0d7d-5fe0-4a99-a381-3b18266e0880.filesusr.com/ugd/6c313a_99e7d2ec32ac4078a8008808e759ebc3.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/e1e84753-8591-40a8-9020-fb506781c37e/lipajijunokirimifepizew.pdfIn PDF document text
  • https://6cdb29d4-22ce-4aaf-9e51-562b59d50851.filesusr.com/ugd/1b20fb_8ebb21e0611740b79199cc08cab97c64.pdf?index=trueIn PDF document text
  • https://ed8bc375-cd54-49ab-9ddb-988cb5b2fc3d.filesusr.com/ugd/3f3824_02765e0132a24d38847502a2efffbed1.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/zerejibixupav/weapons_of_math_destruction_download.pdfIn PDF document text
  • https://dd3528e8-ded0-4753-843e-0d3cb9f542e7.filesusr.com/ugd/4d6844_8489f3c631174dc790a0db395b12dee2.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/petubapizo/big_green_egg_grill_table_cover.pdfIn PDF document text
  • https://d3dd75b0-514a-4dbf-a1f7-973a5b421fb1.filesusr.com/ugd/5b46ec_0a88ac07cf754e65b13f418b930276d1.pdf?index=trueIn PDF document text
  • https://f730d15c-1921-46d2-b6d4-288333e40990.filesusr.com/ugd/e2c223_07ddd731070e4c14a5f7f0119b22df84.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.