Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://zajinet.ru/award?keyword=pathogenicity+islands+pdf PDF link annotation

  • http://talemine.getenjoyment.net/70144393230.pdfIn PDF document text
  • http://xaraxag.mypressonline.com/boxujavuzunesopo.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/bezegoluzose/characterization_practice_worksheet.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/07afbffa-f62c-4133-b7a2-06cb425ae326/zajimuxalu.pdfIn PDF document text
  • https://3e206333-d6ff-4be5-a246-6289f7259d3b.filesusr.com/ugd/973a7d_a4cb8cf8e4804c6f919f8d15a9e0d5ac.pdf?index=trueIn PDF document text
  • https://8a7e94d2-1b07-4399-8a7b-cfebf1eb419e.filesusr.com/ugd/e78b77_f3d18253e36f461481c252498f3ab4f4.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/f475d4d0-7d36-4b74-b38d-cdc1a8d3d3cd/cuales_son_los_sintomas_de_una_neumonia_por_covid.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/98fb0470-e283-43db-8ddf-dab8f6c9ae39/what_size_harness_for_a_dachshund_puppy.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b8efbba3-a4ef-45ff-9059-0a56e4be6ae5/best_free_audio_mixer_software.pdfIn PDF document text
  • https://9534cc33-30dc-483d-bed2-8d5691710d48.filesusr.com/ugd/3835dd_07e6582b64184cf7b145687b34e47af6.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/kelageketisefuv/acknowledgement_letter_for_thesis_report.pdfIn PDF document text
  • https://a819be37-316e-4347-83bc-b067fb6953c8.filesusr.com/ugd/d5662a_1133c5d517214c6eb2f03992bccb34ae.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/e8f8f797-9fa0-45d4-b977-7844176e39fe/putulebuduw.pdfIn PDF document text
  • https://s3.amazonaws.com/nopomewegobij/sample_business_proposal_in_apa_format.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1584916c-1df5-4ea3-ad84-d7c47a5c4887/1464430250.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/112c58ff-a689-4c67-a80b-e6c310687761/86551368999.pdfIn PDF document text
  • http://roporuti.onlinewebshop.net/blood_pressure_measurement_procedure.pdfIn PDF document text
  • https://8d5bcf17-53f2-4f21-b585-7a27aef14131.filesusr.com/ugd/7baf93_700c159588eb45f0a86e67741b1322d2.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/kegubinefuda/38389206477.pdfIn PDF document text
  • https://507f79ed-2408-4027-b124-45ed49bded7d.filesusr.com/ugd/2de61b_98ba9f35897e4b73a04444cfb6fb728b.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/numegubowalonan/ge_spacemaker_microwave_xl1800_f3_error_code.pdfIn PDF document text
  • https://27f1a270-5048-4778-87f0-574dfe85248a.filesusr.com/ugd/b7306e_f0a26f289aa04e9ba69e72712b3aa383.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/43eb573e-cbba-4770-93bf-748b72669820/34344469935.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5c54cd46-0c5f-49ce-a339-b3e3a143115c/97370002840.pdfIn PDF document text
  • https://72cee60b-533f-4fda-9f40-87b1bb6f0553.filesusr.com/ugd/590778_96fa0a7426a6493d9e40e5fe3a27154c.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.