Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dafemum.ru/wix?keyword=idle+miner+apk+mod PDF link annotation

  • https://jurujixomegisi.weebly.com/uploads/1/3/4/7/134745805/1aee1a0d2367.pdfIn PDF document text
  • http://wekeb.space/overwatch_lucio_boop_guidew1nki.pdfIn PDF document text
  • http://kubojep.iblogger.org/new_look_white_slogan_t_shirts.pdfIn PDF document text
  • https://cdn.sqhk.co/fujavuraleko/gqJAJhg/limiting_reactant_examples_with_answers.pdfIn PDF document text
  • https://tugalebuwe.weebly.com/uploads/1/3/4/0/134012885/riluvomuxok-kikoni.pdfIn PDF document text
  • https://cdn.sqhk.co/risenulowo/h3Oiagj/duet_song_meaning_in_urdu.pdfIn PDF document text
  • https://cdn.sqhk.co/fezifenax/ZojcpFj/jaragoxerugominu.pdfIn PDF document text
  • http://tokepubex.getenjoyment.net/dinadiralukefiwilovorate.pdfIn PDF document text
  • http://bexemusu.mypressonline.com/anticoagulants_used_in_laboratory.pdfIn PDF document text
  • http://sportplays.ru/189144854729ldhc.pdfIn PDF document text
  • https://vokewubepil.weebly.com/uploads/1/3/4/4/134443825/015b7d7d0b75168.pdfIn PDF document text
  • http://sewakasatixori.medianewsonline.com/camellia_sinensis_plant.pdfIn PDF document text
  • http://fegikiji.iblogger.org/jimamogesiremidisol.pdfIn PDF document text
  • https://cdn.sqhk.co/xixofivib/bgjewjf/sipujivafuwipe.pdfIn PDF document text
  • https://cdn.sqhk.co/goxobuve/jj9ieO3/48808763832.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://d896c2b7-539c-4146-aa8a-b39d26e096d8.filesusr.com/ugd/a98ecc_9d9ad792d2e14dab8c4543654d293ec0.pdf?index=trueIn PDF document text
  • http://tadufadimokoje.epizy.com/metallica_seek_and_destroy_guitar_tab.pdfIn PDF document text
  • https://b73b9701-b1df-43be-b031-73419f87697c.filesusr.com/ugd/bfbd96_f88a399066524f619544df2376229126.pdf?index=trueIn PDF document text
  • http://lanosewidem.rf.gd/artificial_intelligence_lecture_notes_computer_science.pdfIn PDF document text
  • https://b0c090b1-cb02-46d8-8a69-3fb9d82636b6.filesusr.com/ugd/4dbf3f_24911fee3d7344af88fe897ed55cfb0f.pdf?index=trueIn PDF document text
  • http://sigamit.epizy.com/psicologia_de_la_salud_y_calidad_de_vida.pdfIn PDF document text
  • https://5e0c4d4d-41f9-428c-9564-b93e7cff6769.filesusr.com/ugd/510691_5c4cb9a6ba9646268f0056e2e6fa395e.pdf?index=trueIn PDF document text
  • http://lugimeviguv.myartsonline.com/kosalavupoki.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • https://savannah.gnu.org/projects/freefont/In PDF document text
  • http://www.gnu.org/licenses/In PDF document text
  • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.