Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://xajibur.ru/123?utm_term=which+pharma+stocks+to+buy+in+india+2020 PDF link annotation

  • https://gubizelejipeter.weebly.com/uploads/1/3/4/1/134131403/d39a0.pdfIn PDF document text
  • https://kadezejuvi.weebly.com/uploads/1/3/4/6/134603763/guwivivaxob.pdfIn PDF document text
  • https://lovapunosarimol.weebly.com/uploads/1/3/5/4/135401421/c0164d7eb.pdfIn PDF document text
  • https://lagukowimewalis.weebly.com/uploads/1/3/5/3/135335318/xunapomi.pdfIn PDF document text
  • https://muzafudopabebex.weebly.com/uploads/1/3/4/8/134865208/wavuterutifogujavud.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://973697ad-ffa4-4f9d-85cd-0c9d1ea039ee.filesusr.com/ugd/5f5755_67949aab77e34c268c78627112b6fedd.pdf?index=trueIn PDF document text
  • https://662517ce-f374-4037-aebd-99b1dbe00103.filesusr.com/ugd/0c4177_20974014226f43688489d480d0c3f90d.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/jawusawar/62479369792.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/50898a2e-9c25-461f-ab59-94471c4b5cab/86326520054.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7445bb11-dbd9-4920-b305-c25747e72b0e/what_to_use_to_clean_a_saxophone.pdfIn PDF document text
  • https://2cfcb734-ec62-4cd9-b61c-03d4762ad765.filesusr.com/ugd/a891c0_bcdb8d66663545a6a77e98b115ba3af6.pdf?index=trueIn PDF document text
  • https://e055bcc9-c4f1-4c6c-8dcb-0912bf54750f.filesusr.com/ugd/b4a829_fc8dc788817c431c8686fa14fe805c1c.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/0e668f0b-02ef-4220-a843-379f0a057f72/are_green_tip_bullets_illegal.pdfIn PDF document text
  • https://s3.amazonaws.com/bupijila/rinotolotejafukuzu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9863cee9-f732-4dea-b42f-65037e9a6491/rasojakafexisukubofanur.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e2cd2758-1a67-410b-8e9f-9c532739f2fe/are_maytag_washers_any_good.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7099926d-9ddf-4c75-92ca-4940e1a810f4/the_seven_sins_of_memory_by_daniel_l._schacter.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b61f235c-0731-4058-89f6-58e3cd81dad7/how_to_calculate_power_loss.pdfIn PDF document text
  • https://e5eb5b25-b33c-43e3-82d5-57ab1bf863d8.filesusr.com/ugd/b0c717_5aecd0c2b1b048ada06091d7e84dba3d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/7a8eecab-3df5-4baa-a650-a0d4fcbd584f/modelo_de_contrato_de_arrendamiento_de_vivienda_urbana_sencillo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/19f9faf5-1339-4688-a88b-ce6e35626a0f/93341818683.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8515d42a-16cd-484c-8e15-542ea51545bd/why_is_my_uconnect_bluetooth_not_working.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.