Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://xajibur.ru/aws?utm_term=how+many+calories+do+jumping+jacks+burn+per+hour PDF link annotation

  • http://peramabejakes.sportsontheweb.net/lightning_protection_book.pdfIn PDF document text
  • http://kijumubafenu.mypressonline.com/26222721729.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://023e3b0e-89aa-4e00-bd19-175c11a0a9c0.filesusr.com/ugd/5f4883_beec817fffa94c25b2ad8be7bb27a449.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/sefepugolupalax/21692524622.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4b23c741-1e91-42b1-bd0a-2bb0f91392f1/python_remote_car_starter_instructions_for_reset.pdfIn PDF document text
  • https://s3.amazonaws.com/rotowan/cisco_ios_intrusion_prevention_system_deployment_guide.pdfIn PDF document text
  • http://fijorolur.myartsonline.com/definition_of_urban_development.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c0e942c7-6cc1-4e42-8257-e658737257ea/55627780665.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ea1a69c0-6d85-4a36-8c2e-e29f41aa6823/81228706150.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ddb52e77-48f5-48ff-b9d7-3c08a0d19689/ver_pelicula_completa_gratis_la_ciudad_y_los_perros.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1a3b382b-79b6-4bc6-8617-5944dee4043a/waluwezemiboxiko.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d7a332de-27e2-46df-9438-025c1eca90cc/duromax_hybrid_dual_fuel_xp4400eh_4_400-watt_portable_generator.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8f517b3d-e0ad-43bd-ad8b-2c06cfe2b394/36536594287.pdfIn PDF document text
  • https://s3.amazonaws.com/retisovojor/wukoxufiwurudowifoga.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4c6ca885-f6b5-4a07-9a46-97b70c83eb83/angles_in_a_polygon_worksheet_answers.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e26a3be0-d4ab-4b34-9a7a-b44e92148970/summary_of_cien_anos_de_soledad.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d8ad8524-e3ce-4085-928e-cb29ad1bb6ab/meade_instruments_8-inch_lx200-acf_f_10.pdfIn PDF document text
  • https://65de77fc-0341-4fd2-89b2-cd6b005a91de.filesusr.com/ugd/cf79db_121c8e4a118c4278819d535c7415881c.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/kifutizijebuj/12th_konar_tamil_guide.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a6662220-2a67-4cdd-b353-2d4de240e71f/89911045418.pdfIn PDF document text
  • https://b5526579-b22d-45a0-8251-9885a72cf3eb.filesusr.com/ugd/0cd019_608ee72005484ad88504027c11a83112.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2056baea-7871-49a7-8aa2-68b04911d22b/att_remote_support_application.pdfIn PDF document text
  • https://189c2d36-84ff-4b81-9465-96c33c1d3b91.filesusr.com/ugd/35ddae_712c9c03fcbc43fe9df3e86401db4041.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/09f55dfc-bae7-4cb2-8042-9b50169596c5/gaxokovo.pdfIn PDF document text
  • https://s3.amazonaws.com/novifamigot/are_mini_rex_bunnies_good_pets.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.