Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://baarspo.ru/award?keyword=common+accidents+at+home+pdf PDF link annotation

  • http://rupaduwovuw.getenjoyment.net/antenna_theory_nptel.pdfIn PDF document text
  • http://miwewumexurigan.sportsontheweb.net/airline_icao_codes.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/c09504ab-4f75-4ab3-a2b3-e33e071b963f/java_swing_timer_example.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9f8b52a8-d9ef-49d2-9905-62ebf2512b07/snugride_click_connect_30_vs_lx.pdfIn PDF document text
  • https://5a1138df-423b-4a5d-a7c7-36223740754e.filesusr.com/ugd/a72fa8_2a49bd68ffb849bdb438bde7b4cf0da4.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/dde48e6b-69c6-4fa3-997c-1935a9c36c05/soginenevaxiba.pdfIn PDF document text
  • http://bumurulepowele.myartsonline.com/apple_ipod_shuffle_4th_generation_waterproof.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/922a24ac-8de4-4bee-87d3-4608159bf40b/vac_simplicity_user_manual.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1f3cf884-e733-4611-9643-4b25b9ee7501/nosun.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1c5c0398-c319-46d0-9248-49d28fff5488/midnight_sun_softcover_book.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/12c9323f-7e8f-44ef-b26f-edaa202ac168/92535056300.pdfIn PDF document text
  • http://tebuwawezizafes.onlinewebshop.net/53505892160.pdfIn PDF document text
  • https://eac5c218-d238-408c-98a6-8ff0ecbb25fc.filesusr.com/ugd/b1277d_4e97b967c9af487cbd7357a51b43155e.pdf?index=trueIn PDF document text
  • https://44f68060-d5e3-4d58-b4e7-e3760392f352.filesusr.com/ugd/49488e_23df29ffd59145f499f60e08c52cc580.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/d0b9c97d-6d66-47a4-9ab0-852605aec609/91272258857.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3ea1410f-8dc2-4cc9-83f5-bb870f17f3a2/how_many_calories_in_a_small_sonic_blast.pdfIn PDF document text
  • http://juludiripo.myartsonline.com/counseling_theories_and_techniques_summary.pdfIn PDF document text
  • http://fuxunowelujuxa.atwebpages.com/free_multiplication_worksheets_grade_4.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b1ff02e3-1e73-4e7b-9127-36a37e37018c/81254236482.pdfIn PDF document text
  • https://df1882fa-13c5-42f1-8438-577935b594b9.filesusr.com/ugd/91932b_0b5f6cf9e001434aaa504e52a66f8615.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/153e31e0-8012-43ca-99e3-d45ef2c60104/xifogisoxexapebazude.pdfIn PDF document text
  • https://636e06b3-920c-4898-b827-ef778bbbc101.filesusr.com/ugd/40512e_59f8c8ffa71b435bbcdcfe92792bf9b3.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/307dd8a6-fa19-4a8d-b8ff-c484613fbcd4/understanding_normal_and_clinical_nutrition_10th_edition_free.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c06ed531-eead-466b-a333-928ffafbd0e4/22021605526.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.