Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://lozipotod.ru/award?keyword=instrumentation+lab+manual+for+mechanical+engineering+pdf PDF link annotation

  • https://cdn.sqhk.co/soxuvezosapa/hFDigHd/power_bi_tooltip_report.pdfIn PDF document text
  • https://ramilelajebow.weebly.com/uploads/1/3/4/6/134647205/jekunovewijeli.pdfIn PDF document text
  • https://cdn.sqhk.co/xovikojux/hcgege3/ninja_shake_blender.pdfIn PDF document text
  • https://loratabupufedev.weebly.com/uploads/1/3/2/6/132695903/lunapenasuginapibom.pdfIn PDF document text
  • https://cdn.sqhk.co/zokuwagopole/pMAjdhc/nhlbi_pediatric_lipid_guidelines.pdfIn PDF document text
  • https://lanekugufer.weebly.com/uploads/1/3/5/3/135351315/vosogejegi_jeviwar_vasixe_pugoto.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://86cafecd-0af7-43e6-b578-14605c742a6c.filesusr.com/ugd/c4ddd0_c59b453268f845a8a532c4dddf74e07d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/d8391e6e-f6b6-4e94-b32a-4932bdca8420/what_is_the_most_famous_quote_from_romeo_and_juliet.pdfIn PDF document text
  • https://8909b315-4d59-4940-aabf-0fdaa532e0ad.filesusr.com/ugd/4542d9_e16d3186fefe4532b55eb9dfb00dbb0f.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/3a1578a1-86fc-4abd-8e2e-792120af1e94/operating_systems_life_cycle_chart.pdfIn PDF document text
  • http://nenidexixod.epizy.com/29563462651.pdfIn PDF document text
  • https://82c1a4a6-0aea-44ab-842b-07cb5bdde860.filesusr.com/ugd/aafee9_13139d6dbcb24f0bb7bb271801f2f121.pdf?index=trueIn PDF document text
  • https://c6f55193-7475-4343-97dd-33cb3b141b6a.filesusr.com/ugd/808d8c_c05738d3a8f84577a40a7f4a13c1907a.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/5e54a7b8-1875-4af0-9366-00fd57e49b03/minusitoka.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f589a282-44b4-445b-ae43-210fc91b4080/96419651697.pdfIn PDF document text
  • http://morufigalolo.rf.gd/62650041152.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b77ba6cd-4afc-4e1e-8234-42247c1a12a5/indian_vegetarian_detox_diet_plan_for_weight_loss.pdfIn PDF document text
  • https://d670dda7-df53-4ef1-8eda-d3256df28744.filesusr.com/ugd/dbbbec_6c4a0380e1214b58b852a3d27d5d9c58.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/d060644e-540b-4722-9834-8edd4f6330f9/beethoven_piano_sonata_no_19.pdfIn PDF document text
  • http://givemuzod.epizy.com/convertir_de_a_word_descargar_programa.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.