Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://botokaw.ru/award?keyword=what+is+the+abbreviation+for+neighborhood PDF link annotation

  • http://beliyden.xyz/sufonabarugixajewigohli.pdfIn PDF document text
  • https://ruxapumuful.weebly.com/uploads/1/3/4/6/134682584/15f5a9ffa4ec2f2.pdfIn PDF document text
  • https://juwexulomo.weebly.com/uploads/1/3/4/3/134385858/769c50fa4fffd.pdfIn PDF document text
  • https://gepogujewo.weebly.com/uploads/1/3/1/3/131382217/nilezixugubo.pdfIn PDF document text
  • https://silixumofabu.weebly.com/uploads/1/3/2/7/132712413/4515731.pdfIn PDF document text
  • https://jadomuvifaxa.weebly.com/uploads/1/3/5/9/135960305/dinuli.pdfIn PDF document text
  • http://ru-payment.casa/koxono4o7mw.pdfIn PDF document text
  • http://austritkfa.com/xelakifagalukefiwubuxarivtu4.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://f7e05ffc-afae-4d19-be15-7e9c659e5e5f.filesusr.com/ugd/72f62b_30fc3db1c5af44ac9b32e6b257b384b9.pdf?index=trueIn PDF document text
  • https://57eba762-b826-4879-8d7a-7f480aba2934.filesusr.com/ugd/e89c2b_6f97c3cd9fa44073979db4cfa91778be.pdf?index=trueIn PDF document text
  • https://a84030a7-2e48-4039-807a-383e2b7216cc.filesusr.com/ugd/c5d40f_422f21f7e91046b0b43bb653f7bea3ac.pdf?index=trueIn PDF document text
  • http://nimozan.epizy.com/wusidasudeduw.pdfIn PDF document text
  • https://6843e3eb-5573-46e1-90a0-370cfc2b4a0d.filesusr.com/ugd/89b1bc_f1088011633642aaa04c3e37c14f4216.pdf?index=trueIn PDF document text
  • https://4454cc88-256b-48ad-9013-c0414c72072d.filesusr.com/ugd/67e251_4e64b391242446d3880ee93c08bde072.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/7a726a10-aaff-40ec-8a97-9cbc8e07c1e7/tom_clancy_the_division_book_series_order.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/af5de5df-8649-426e-827d-dc5671095152/how_to_program_a_universal_remote_magnavox.pdfIn PDF document text
  • https://0dc5016f-38c0-4e11-84f4-4717e3ef4ec7.filesusr.com/ugd/4fd84c_75986909e6df4088879dfb5914dbe558.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2267df1f-1bc2-4d94-bf3a-a5f411857f57/tintin_comics_free_download.pdfIn PDF document text
  • https://af18ad75-7652-4b25-b9e0-8da5fded0af1.filesusr.com/ugd/529385_4e3cdd899f194ffc8254e973691babd6.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/e1d54c99-83ef-454f-99f7-dbde4b20b2fd/begajewaxazo.pdfIn PDF document text
  • http://sosurovupek.epizy.com/22124988499.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6bd8b0fa-8477-417a-b70e-ff9f05f9f224/movozomuwojatipotego.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.