Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://mezovuduw.ru/wix?keyword=module+2+study+guide+math PDF link annotation

  • https://jitaginedisa.weebly.com/uploads/1/3/4/3/134324559/nunug.pdfIn PDF document text
  • https://cdn.sqhk.co/ruvuwoki/bgjgibn/65059753761.pdfIn PDF document text
  • https://cdn.sqhk.co/bitowiso/ePfSCig/gas_prices_in_the_united_states.pdfIn PDF document text
  • https://dufavepuxafolim.weebly.com/uploads/1/3/4/2/134266173/7470451.pdfIn PDF document text
  • https://jutoxanifi.weebly.com/uploads/1/3/5/3/135321179/91a7577d414f886.pdfIn PDF document text
  • https://cdn.sqhk.co/mujekesire/genV3Ea/device_care_samsung_s20.pdfIn PDF document text
  • https://cdn.sqhk.co/balaragu/iUthtIZ/sagopuvoxexifufamunuz.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/7bc31af3-4723-406a-8ff0-0c0d5b23fdf7/business_mathematics_college_course.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f31840a8-a1ab-4fd0-91d3-8d75de316c29/kydex_holster_for_ruger_lcp_with_lasermax.pdfIn PDF document text
  • https://5fa60de5-32ab-41ac-ba65-77330e21e623.filesusr.com/ugd/2e16aa_3a6100159599401aa45219130521f7e6.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/c5e9f22d-aba3-4693-b44d-ae02f045f12e/93883118218.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b8f28bd6-97a3-402f-84c0-cba5318d009a/old_snapper_riding_mowers_for_sale_near_me.pdfIn PDF document text
  • https://1ac5d900-0c69-4f12-8b1d-4e209472b8d2.filesusr.com/ugd/828753_9a5626e2f8ab4f2cafba6dbed8930fec.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/1837f141-fed2-49bf-bc02-054f17b9f1f1/semebedumivixumibofuluzi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5437d91b-f74f-4e60-94ec-f1eb9a7e2df7/15965387500.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f1a26d4e-26f8-4015-a660-00474a884112/34155377879.pdfIn PDF document text
  • https://95e354e6-8561-4e52-807b-deb85f3b5fdd.filesusr.com/ugd/ca9b0a_02cc12eb6edf485781ef6d4b379a3eb1.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/983fc545-d372-45d3-82ef-5c91dc71f918/98208223241.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/50abe429-c9f3-469d-bbf6-a746a247027d/64740043545.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/837e2f27-f6c3-4ebf-b3b3-15faca93c1a8/diboxas.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f2521b92-8445-45ae-9694-0c0cd531defe/ecuaciones_de_primer_grado_segundo_grado.pdfIn PDF document text
  • https://d6236f05-450e-4b96-9875-1783d83c708b.filesusr.com/ugd/912de2_080ef108009748aba06f39e9c111643a.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.