Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Urgency / deadline lure low SE_URGENCY_LURE
  Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jumiwimov.ru/wix?keyword=facts+norovirus+infection PDF link annotation

  • http://callipakk2.site/distance_vs_time_graph_worksheet_answersct5sa.pdfIn PDF document text
  • http://mysteps.online/88614010726d4vdd.pdfIn PDF document text
  • http://gta-msk.ru/the_tell-tale_heart_scholasticz6h2f.pdfIn PDF document text
  • http://homebig.space/tales_from_the_time_loop_free_downloadq18v8.pdfIn PDF document text
  • http://lawobusupovapuv.22web.org/43595767698.pdfIn PDF document text
  • http://all-system7.club/vabisorog1t137.pdfIn PDF document text
  • http://raxewaponoxiv.mygamesonline.org/sapadaw.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • http://tudixavanalomig.rf.gd/61535085896.pdfIn PDF document text
  • http://xedaxabefax.rf.gd/a_textbook_of_industrial_microbiology_cruger_download.pdfIn PDF document text
  • https://a86a6b26-b473-4b55-b9aa-7628a2bff077.filesusr.com/ugd/4f270c_b8a0a351e9254d95bb009f86b4809421.pdf?index=trueIn PDF document text
  • http://ratagewenik.epizy.com/bgv_form_abbreviation.pdfIn PDF document text
  • http://xizokenimufewom.atwebpages.com/92180655917.pdfIn PDF document text
  • http://megalikivokilir.rf.gd/42697414197.pdfIn PDF document text
  • https://d190c387-1498-4382-a59e-98d1a0a9794c.filesusr.com/ugd/a91264_de5f253898574a9b84ae6cca4a03c1aa.pdf?index=trueIn PDF document text
  • https://24a70dd4-b549-4b9e-9c0a-6eea45ab85ad.filesusr.com/ugd/ab0c63_72fc52c666da4bd39d21e7d843041519.pdf?index=trueIn PDF document text
  • https://d992f69e-bc5b-430a-92d7-abfd66d0380b.filesusr.com/ugd/6f7357_9843b0591aee490d9e4f81da8d884a0a.pdf?index=trueIn PDF document text
  • https://4abf464d-34d5-4c80-8de5-e64f30e04530.filesusr.com/ugd/8b3eb5_b8805066c7b94a0a8766ed582afc95e8.pdf?index=trueIn PDF document text
  • https://73a1781f-5c9f-4c76-8a11-a8e8c44f336a.filesusr.com/ugd/d9f7b5_23e381a571f8414d9bd23d331f13a52c.pdf?index=trueIn PDF document text
  • https://7a9095e9-4ba3-4ff7-9406-a75d0382ce8a.filesusr.com/ugd/db93e9_3750eccf62ed429ab94900ee85c7938d.pdf?index=trueIn PDF document text
  • https://ed21222e-fee3-4fab-8b52-e2ddb7bb35ab.filesusr.com/ugd/e73fea_4ea83a79e07247b5a056532953594e9d.pdf?index=trueIn PDF document text
  • https://f1cb2ec4-a82d-4768-8a06-5236a2db220e.filesusr.com/ugd/a2e20a_3733a767c6324e4f91b8f4aabc87c639.pdf?index=trueIn PDF document text
  • https://6d23287f-a15b-43b7-8d69-700c0e01f504.filesusr.com/ugd/185c00_440ff813485e4f0d9202845f78ddc33f.pdf?index=trueIn PDF document text
  • https://6eed613e-cbae-405e-b458-9655ef9033f8.filesusr.com/ugd/e4f6f0_8953822f7eaf448ea84b4d68e8b70c8a.pdf?index=trueIn PDF document text
  • https://ca39a19f-16f9-469f-ab0b-65ec0463b8d0.filesusr.com/ugd/cc9b97_f1e53725f2fe4178be42699cbe7d2d9b.pdf?index=trueIn PDF document text
  • http://tiluxusimutine.atwebpages.com/83238375998.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.