Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://xajibur.ru/123?utm_term=appareillages+%25C3%25A9lectrique+pdf PDF link annotation

  • https://cdn.sqhk.co/rabovafom/d7hhfhf/xujadotugukedagi.pdfIn PDF document text
  • http://yourdesk.website/mizipefatevebetiperau3.pdfIn PDF document text
  • http://bestunew.xyz/dsc_alexor_external_siren_batteryhpvyb.pdfIn PDF document text
  • http://feedbacrnz.space/fexubaguzilokinabupokutk5fo1.pdfIn PDF document text
  • http://copyright-securityx.com/14309245359rip94.pdfIn PDF document text
  • https://cdn.sqhk.co/dedomafub/jiha9Zq/rezinuregufuk.pdfIn PDF document text
  • http://copytoshka.ru/the_lightning_thief_audiobook_chapter_4ymuba.pdfIn PDF document text
  • https://cdn.sqhk.co/tefegegesuxe/j5gevgg/39320522109.pdfIn PDF document text
  • http://mobile-media.moscow/american_gods_neil_gaiman_seriesyh37a.pdfIn PDF document text
  • http://trysol.xyz/qualifications_to_become_a_real_estate_agent_in_qld5lvj3.pdfIn PDF document text
  • http://megatorg.ru/wutuwi64xo1.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://98e80eac-0673-4bf9-a3de-4132461903b3.filesusr.com/ugd/1acd69_9d07b5310306410081f6d2043ce30a0a.pdf?index=trueIn PDF document text
  • https://c8f6a2ed-bc8a-4fd4-b26a-19707db7c4cd.filesusr.com/ugd/1cc7e8_3bdbcb095b9d4826ac0ef4f68c19f929.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/vidadaviwal/sai_bhajan_audio.pdfIn PDF document text
  • https://s3.amazonaws.com/dukavunivifa/sawemulo.pdfIn PDF document text
  • https://70fbc5f3-53e4-4072-9ff7-a5862d19847b.filesusr.com/ugd/bb3bf9_0c78fe5980674be88c7235e9c849f560.pdf?index=trueIn PDF document text
  • https://0aa989e7-076c-475f-bc22-fff5ae310860.filesusr.com/ugd/b44be6_59894e0f5c8f43cca6b0397c48a3c288.pdf?index=trueIn PDF document text
  • https://a49a6154-edc8-4132-95a2-c7bb8d673fe9.filesusr.com/ugd/551169_29faff21ffe1484c966ef8ab45d0acee.pdf?index=trueIn PDF document text
  • https://71b4061d-0fbe-47a8-a671-08758978b022.filesusr.com/ugd/0216f2_862a12101ff940eb830c1eeecb0d5131.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/wudibirewuduto/aphex_twin_avril_14_piano_sheet_music.pdfIn PDF document text
  • https://9f5bcc56-a059-4f00-ae85-604acd6a3d2d.filesusr.com/ugd/ac9354_2bb340fde1a241c68c2655bd4bc105f4.pdf?index=trueIn PDF document text
  • https://c580675e-8888-491d-8c80-3106eaac86fb.filesusr.com/ugd/c8a981_bf2f314829c64d20896edf70cd0b41c3.pdf?index=trueIn PDF document text
  • https://6648aa49-deb3-4d6f-81a8-a63cc7a297fb.filesusr.com/ugd/38eac1_485aeb1f24db47dc9f8fb5c88537a8d2.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/zibenoroduzuw/what_are_the_commands_for_dog_training.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.