Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://gimoguvi.ru/strik?utm_term=why+was+magna+carta+important+brainly PDF link annotation

  • http://zobotalemogi.sportsontheweb.net/nazipaxituwosopufesebeti.pdfIn PDF document text
  • http://zuzavepojul.mygamesonline.org/wikewo.pdfIn PDF document text
  • http://masozaxo.22web.org/adjektivdeklination_deutsch.pdfIn PDF document text
  • http://subuxiwubemew.getenjoyment.net/wijegadugejetogun.pdfIn PDF document text
  • http://fruit-citrus.space/3ds_max_step_by_step_tutorials_for_bbhdfy.pdfIn PDF document text
  • http://xofazonir.iblogger.org/muwixekimuronasoviwepu.pdfIn PDF document text
  • http://laxogapajoze.getenjoyment.net/14877670307.pdfIn PDF document text
  • http://honbiz.pro/46567438656mu3zd.pdfIn PDF document text
  • http://litufunijefud.iblogger.org/cateterismo_vesical.pdfIn PDF document text
  • http://kdghy.online/marshall_dsl40c_amp_reviewz08u6.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://b70645e9-42d7-44c6-80f2-f165c8819e8d.filesusr.com/ugd/3f1130_c408b61dcde047b198eea4f3a2b57b91.pdf?index=trueIn PDF document text
  • https://e0220c8c-c322-4c33-af83-7c5b0fe00b66.filesusr.com/ugd/a771bd_6d7dca3ded3b4fb684f6fbcbd1d561e8.pdf?index=trueIn PDF document text
  • https://181f3bdf-810f-4c34-abb3-9f3362228cd6.filesusr.com/ugd/30415f_0d01698f0ee5460399edff8a55af7b0c.pdf?index=trueIn PDF document text
  • http://dapizodipe.myartsonline.com/how_much_does_a_baby_grand_piano_cost_used.pdfIn PDF document text
  • https://3f740848-0e57-4b51-8596-564812021bec.filesusr.com/ugd/cbe17c_f604f8c2288340cdae0335bb9d6c6703.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/077206a3-678c-46c4-865a-6c4ec316740c/jafudar.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/90ac2377-8eff-4d0a-9425-4770252acd22/xupuvup.pdfIn PDF document text
  • https://c7fb3737-a2fb-4e06-b71d-f78b648bb0a4.filesusr.com/ugd/a9248e_599531bb3db74c04aa1abf356adedf71.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/5dd14c90-26e0-4743-b89c-008c6db1a18f/advanced_dungeons_and_dragons_2nd_edition_espaol.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8b2816b6-d573-4d1f-af30-88628cdcc012/what_are_the_four_types_of_informative_speeches_discussed_in_this_chapter.pdfIn PDF document text
  • http://nepogewapiw.epizy.com/jodanerudotejubeb.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e13b9496-fb58-4569-97cb-93e8cb402556/how_to_cite_words_from_a_song.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/22b22ee5-1110-4e94-9953-f1f404a2e50a/how_to_mig_weld_correctly.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b12fc66a-a9a1-49bf-bad8-20b98d8b2d28/vadodabotusit.pdfIn PDF document text
  • http://xelepidozagetof.epizy.com/brahmastra_advanced_maths.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a9b666a7-a865-46da-8fd9-0c53e1826d3b/babubetuwurugufek.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.