Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://golowaki.ru/award?keyword=anthropology+optional+syllabus+pdf+download PDF link annotation

  • https://static.s123-cdn-static.com/uploads/4461509/normal_5fef0b11d82a7.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4365662/normal_603b1695b0b48.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4450355/normal_5fe769bbded26.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4493209/normal_5fc940b1689b9.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4475734/normal_5ff1ee6150a22.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4456666/normal_600ff6365ee5a.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4385014/normal_5ffab900abcf0.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4460946/normal_604ebca24f241.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://6552665f-f3ce-4070-9f47-7b493df4570a.filesusr.com/ugd/3d88c7_5b2c7d42373e47ae80740d334ec50bb1.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/pavujiniz/context_clues_practice_exercises_answer_key.pdfIn PDF document text
  • https://d872ce2a-2baf-4032-ab86-ab75b2f66d52.filesusr.com/ugd/338562_cb95808735ce4a2c861d3c5815a2dc5a.pdf?index=trueIn PDF document text
  • https://df256b98-640c-444d-885a-8195c7360722.filesusr.com/ugd/40b9e6_5cfa130721ec4c659eba72a0208bc188.pdf?index=trueIn PDF document text
  • https://26577e91-18e8-42c3-8e85-49dcca1d6605.filesusr.com/ugd/195787_8af6a78a42ab4d4b93e15000ee213f61.pdf?index=trueIn PDF document text
  • http://tomedokuboder.epizy.com/actinides_properties.pdfIn PDF document text
  • https://737c154f-ca75-4484-807d-9d5c19d76377.filesusr.com/ugd/7e84b7_54a76af6855049389073277e7a47d183.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/kawotexulozax/pimogofabuxetamenukutuzaj.pdfIn PDF document text
  • http://lobaman.epizy.com/jewekuku.pdfIn PDF document text
  • https://c5b3e1fc-3b55-407d-a8d9-2bfa6c9015c1.filesusr.com/ugd/6df244_7bf7467911e845609ffeaa2c66b1dcf2.pdf?index=trueIn PDF document text
  • https://dbb1fad9-9c05-458f-9e32-bc0b7f65d7ec.filesusr.com/ugd/451461_ddd1b95b85c8427da168e90037b34e80.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/mozedijiz/zonarevotipugogazaval.pdfIn PDF document text
  • http://dinoxisajuz.rf.gd/gnomeregan_guide_classic.pdfIn PDF document text
  • http://biborufa.epizy.com/sunrise_our_last_night_piano_sheet_music.pdfIn PDF document text
  • https://9cf93ecd-64ee-4ad6-afcc-f350577a7522.filesusr.com/ugd/c4dbd3_cfb563104b594d50a4c06fe7771fc61c.pdf?index=trueIn PDF document text
  • https://f9fc249e-2e6a-4908-9eb0-88005465a50d.filesusr.com/ugd/2530ee_fb5fbecdcdf9469cb041efe4ec3c9edc.pdf?index=trueIn PDF document text
  • http://vazalavowudepip.epizy.com/kuwevutuzirawovapedegifez.pdfIn PDF document text
  • https://s3.amazonaws.com/wujanozo/how_do_you_setup_a_rca_universal_remote_to_your_tv.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.