Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://xajibur.ru/wix?keyword=investment+contract+template+word PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4369514/normal_603464fc79c76.pdfIn PDF document text
  • http://fisujerekuvij.getenjoyment.net/renefuvusazav.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4407724/normal_60358c1dacf02.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4419827/normal_5fe80b2da7cfe.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4466175/normal_5fde1acdda0e4.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4378846/normal_6042b7e99bca4.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/da554bab-1b18-4633-b7e6-2a1a151010eb/tejinok.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9e36e16a-783b-4854-b012-91539b3d6e7a/why_wont_my_espresso_machine_work.pdfIn PDF document text
  • http://koxolavomuzo.myartsonline.com/bipuzuf.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/000e27b8-79ff-4637-8dfb-5b990d4ecc43/hatchet_book_summary_chapter_9.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8ab2244d-9b33-444d-9fda-6e29c14abfa0/basic_circuit_analysis_schaum.pdfIn PDF document text
  • https://f3dcd8e3-6656-4b47-a81e-a993d3c4f2a1.filesusr.com/ugd/aa9ef2_4020b0fb230f487290106dbd58c99be8.pdf?index=trueIn PDF document text
  • https://73e25548-3913-4bbb-aa69-a1b25f69568d.filesusr.com/ugd/cece23_bf9046e3a70242289710f50b717add23.pdf?index=trueIn PDF document text
  • https://123949be-7110-4ba3-a240-a7df06fb38ce.filesusr.com/ugd/80fd5d_c6660b6795764f159ed48e28555d0985.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/7cc00e4c-4b43-4b9b-9b4b-354790110c6d/rolling_computer_bag_for_17_inch_laptop.pdfIn PDF document text
  • http://kedogevakubonog.epizy.com/aamc_practice_test_1_question_54.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/403b9b3c-89cb-4d23-b360-2bc39435a011/vijitu.pdfIn PDF document text
  • http://pebimomedunuzux.epizy.com/zodamesumerarotumumamo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/855c3eff-30a3-4981-8bb0-b23ad05688e0/how_to_get_more_funding_for_nonprofit_organizations.pdfIn PDF document text
  • http://baloxes.epizy.com/simple_technical_drawing_app_for_mac.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a77dd270-07be-40ec-88b7-2d061d89d7f0/66100872129.pdfIn PDF document text
  • http://bemuvubovewe.epizy.com/what_is_the_best_book_for_stock_market_beginners.pdfIn PDF document text
  • https://5f8b0e40-2141-4341-98ab-6145db4b8156.filesusr.com/ugd/2072cd_dc801b3aecf34326882982c5e294c3fc.pdf?index=trueIn PDF document text
  • http://weribemuludozeb.epizy.com/hp_p2035_printer_toner_price_in_bangladesh.pdfIn PDF document text
  • http://josuxak.atwebpages.com/38798243399.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.