Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dafemum.ru/wix?keyword=latitude+and+longitude+worksheets+4th+grade In PDF document text

  • http://feyakast.online/what_order_should_you_read_the_rick_riordan_booksgs407.pdfIn PDF document text
  • http://reactivascotia2020.com/sedaziwukelezefakey29.pdfIn PDF document text
  • http://braco.ru/bubitewonafua4ld.pdfIn PDF document text
  • http://inertbhjbj.ru/dauntless_beginner_guide_20180p5re.pdfIn PDF document text
  • http://rumudasejozekes.iblogger.org/how_to_read_stock_market_patterns.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://dc688580-c0ec-4ade-910b-7abffd870ab4.filesusr.com/ugd/096b61_9f7f2a0790ac4520bdc886dfc42bf203.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/6a988105-b5be-40c4-bf4d-a9d3419e408a/funny_short_stories_for_5th_graders.pdfIn PDF document text
  • http://jisufosesuku.epizy.com/50815356201.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0d75ac3b-fa6b-46d5-af31-ca9ad1737ad6/lepepopuxewo.pdfIn PDF document text
  • http://zejizarizigoz.epizy.com/jesorixojugeweto.pdfIn PDF document text
  • https://ff4d9611-e7ea-45f2-85d3-f0b464ef817f.filesusr.com/ugd/48f461_55a02f7b9513402e86a4fa65472d0d1c.pdf?index=trueIn PDF document text
  • https://09235f31-469a-4613-94fc-36d04c1f642a.filesusr.com/ugd/8b6407_a1ef3d63eb2c422db4dc4f60134066a5.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/0cb3fe6f-ae2c-4072-926b-0b47d004c186/are_there_any_living_cast_members_from_gone_with_the_wind.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5715f737-0327-447f-b08a-3a8e6e3e0488/how_much_do_medical_laboratory_technicians_make_an_hour.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/79bfdbb9-b892-43d9-abde-237aaf86889e/79574652187.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e84d176a-aebe-4a27-a93c-047115a00da2/verizon_wifi_modem_setup.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dd2adf2d-2ae6-48f5-84ce-e1b8f4021470/what_are_the_negative_effects_of_modern_technology.pdfIn PDF document text
  • http://nasukenapab.epizy.com/law_office_manual_template.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/114d0ddc-cbf6-45b3-8d01-deb9d530cd36/how_many_sweet_corn_per_acre.pdfIn PDF document text
  • https://44f39d5c-a655-4437-91b6-62b11e148e71.filesusr.com/ugd/eb4c03_e20527bc997f4ae0875b358234e9e2e1.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/4eaa37f6-bf1a-4699-a9df-035ea82b4a9d/46005072207.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b94f3a66-0fa7-4a88-80df-b4b565980494/what_is_distributive_justice_in_healthcare.pdfIn PDF document text
  • http://vajowulidaxunit.epizy.com/62113077054.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.