Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jottigo.ru/award?keyword=kerala+hindu+baby+names+malayalam+pdf PDF link annotation

  • http://vurejowug.mypressonline.com/reliability_engineering_singiresu_s._rao.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://smc.org.in)MeeraRegularMeera2016SMC7.0.0+20171102HussainIn PDF document text
  • http://smc.org.inhttp://smc.org.inIn PDF document text
  • http://fedorahosted.org/lohitIn PDF document text
  • https://da18e6a8-d720-42de-a88c-3f13daad7efb.filesusr.com/ugd/08fe48_8dea9e0016174276913b08dbb28fbc0d.pdf?index=trueIn PDF document text
  • https://71a0d42b-91d5-4e94-9338-ff69ca8a624b.filesusr.com/ugd/e5d5e5_9239a2168fba44838995070a8c122a32.pdf?index=trueIn PDF document text
  • http://wiwosotu.myartsonline.com/polk_magnifi_max_soundbar_system_specs.pdfIn PDF document text
  • https://0b7b936c-93ac-4a60-9644-6ba220b934cc.filesusr.com/ugd/b4bf80_c97b173c7cbe42caa4972394ef005c33.pdf?index=trueIn PDF document text
  • https://19eae752-0dc2-40b2-988a-3ead9c543f91.filesusr.com/ugd/dee0a8_f016ffa3338a4bdca511eb6e0ca55d93.pdf?index=trueIn PDF document text
  • https://3857ddc0-2b33-46ba-b4a8-ebef9b167687.filesusr.com/ugd/5cc0d5_3f337f811eb14dedaee031d4e62c4c06.pdf?index=trueIn PDF document text
  • https://88966db1-4a83-4446-b941-f65022a6235f.filesusr.com/ugd/928e0f_f0313ed61ed840a4ab86c50791d75ccb.pdf?index=trueIn PDF document text
  • https://bff5fdab-9fd0-4670-908b-a1308bb5a9cb.filesusr.com/ugd/227d0f_9df470bca95042f1b5788ec125ece28b.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/wulagisi/the_ones_who_walk_away_from_omelas_book_depository.pdfIn PDF document text
  • https://1cf095b7-1d29-4152-b82c-7733cf7ba0c7.filesusr.com/ugd/c1de29_53f2dc232ab64b75bb5efad9de713d28.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/jojitagifuva/catholic_prayer_booklet.pdfIn PDF document text
  • https://dc688580-c0ec-4ade-910b-7abffd870ab4.filesusr.com/ugd/096b61_f0fc0a8df4bb42f78167bbef223fc613.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/widiku/skyrim_razor1911_crack.pdfIn PDF document text
  • http://salajire.onlinewebshop.net/bernina_1080_user_manual.pdfIn PDF document text
  • https://2225f16e-b6a0-48e2-a067-d7e802b71dd4.filesusr.com/ugd/a7ada4_3dfd1b5116e54c76a7cb2cd955ba0b49.pdf?index=trueIn PDF document text
  • https://6ddb26ad-aa8e-4a3e-a925-5cef6fc035e1.filesusr.com/ugd/d3d820_3daa064f674f44d9aa37b528f25be68a.pdf?index=trueIn PDF document text
  • http://tivakifuzir.atwebpages.com/74073523888.pdfIn PDF document text
  • https://s3.amazonaws.com/xanunafojuloki/vermiform_appendix_is_a_part_of.pdfIn PDF document text
  • https://4779f2f8-a33e-4327-9c78-21ee0bcf4620.filesusr.com/ugd/31bf02_92dd0020a4c74ab981ed5707f091b675.pdf?index=trueIn PDF document text
  • https://746420f6-3007-491b-ba72-fd43be5094e5.filesusr.com/ugd/277b62_385671584983487bb189eac9374dc010.pdf?index=trueIn PDF document text
  • https://99470c7d-c692-4648-a7b8-36ea19db2883.filesusr.com/ugd/ab059d_4b478e81095b4881bb2fe169b89a21fd.pdf?index=trueIn PDF document text
  • https://73a1781f-5c9f-4c76-8a11-a8e8c44f336a.filesusr.com/ugd/d9f7b5_ec6d47e94cc049a2ad34bc11f5dbafa8.pdf?index=trueIn PDF document text
  • https://0e8f88b9-656e-4b05-9cd8-8bd477f85547.filesusr.com/ugd/95b9ea_b82216b533ff426c9c8f8b8f15e18158.pdf?index=trueIn PDF document text
  • https://6c8027e1-9878-41b3-a9ef-32ba2b6bcd02.filesusr.com/ugd/185811_6f2a8c2fd8c4492a952801f38deae250.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • https://gitlab.com/smc/meera/blob/master/COPYINGIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.