Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Urgency / deadline lure low SE_URGENCY_LURE
  Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jottigo.ru/award?keyword=alagappan+medicine+5th+edition+pdf PDF link annotation

  • http://fopasezexelori.iblogger.org/87369722648.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://a2876ee3-c470-454a-91e2-e108d831033a.filesusr.com/ugd/e8dba5_770096a4d6f34331aec22b107519990a.pdf?index=trueIn PDF document text
  • https://1261df91-4e32-40b2-8b8a-4050d3c54cbb.filesusr.com/ugd/df69c1_49f1473ff3c64005b007afa85f3e868e.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/3455a497-ddde-4782-8c0a-30c67bc8ab2a/fopujidanavonulolajibuf.pdfIn PDF document text
  • https://s3.amazonaws.com/fonazuzixagizir/48844577041.pdfIn PDF document text
  • https://d21da297-2d1c-4020-882f-059d99c29dc9.filesusr.com/ugd/3724a2_54327ca54b5946cabd623625a9f9db2c.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/19eb9e1b-0300-42de-a39c-3bae78088239/vaporirujaf.pdfIn PDF document text
  • https://d872ce2a-2baf-4032-ab86-ab75b2f66d52.filesusr.com/ugd/338562_b11a24b9dfee4bffb65918972473c793.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/84ffa09a-faa6-497d-b711-6b60dbd90c27/the_summer_i_turned_pretty_tv_series.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/754f9607-158a-4ab7-90df-e9cd759aa5b7/how_to_program_viper_auto_start.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5b50e998-41e3-489b-b46f-a2d2ac319e11/jujofedoluvazikepokad.pdfIn PDF document text
  • http://rozizibuno.epizy.com/29166303138.pdfIn PDF document text
  • https://s3.amazonaws.com/gurowozenupifi/xulifolirusese.pdfIn PDF document text
  • https://s3.amazonaws.com/xijalovelokolep/argument_from_sufficient_reason.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/60468230-91d2-42db-9916-43696dd144dc/5344909507.pdfIn PDF document text
  • https://c064424b-11a8-4e39-a524-24a74bcd733d.filesusr.com/ugd/54e393_7971a1835b94418d90fe1f57baaa0ecb.pdf?index=trueIn PDF document text
  • https://f1801c53-b3f5-4b94-a9b3-4bb8eb376a66.filesusr.com/ugd/af633f_41d4e04f450841ab8be4d7ecd00298d2.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/427a3543-3dc2-45a3-bc30-ef1603285e3b/how_to_hard_reset_flip_video_camera.pdfIn PDF document text
  • https://2a4c341d-9af7-4f89-b48a-1b926ad6ced7.filesusr.com/ugd/dd6616_8e2ae345246a46cc816cf296d947919a.pdf?index=trueIn PDF document text
  • https://68e1e3d4-268d-49bc-a8aa-b119cb10fea7.filesusr.com/ugd/3ceeb9_324b5710a4b04827afbf44aa1a902be6.pdf?index=trueIn PDF document text
  • https://b00f38ea-0d13-4519-ab0f-1253f0d03ca0.filesusr.com/ugd/289c5e_f519b8c8a62a4afba46ab95bd55aaad0.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/1ee5ccec-eddc-400b-a5e9-4cbdbb12b5ad/how_many_characters_are_in_percy_jackson.pdfIn PDF document text
  • http://vipuwizu.epizy.com/dance_monkey_song_free.pdfIn PDF document text
  • https://s3.amazonaws.com/vinejivunitego/apk_traffic_rider_mod_unlimited.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.