Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jacksth.ru/strik?utm_term=how+to+study+for+a+driver%2527s+permit+test PDF link annotation

  • http://nupifijaw.getenjoyment.net/bell_hooks_teaching_to_transgress_introduction_summary.pdfIn PDF document text
  • http://helpcontactform.com/honeyguide_bird_information_in_marathi5120t.pdfIn PDF document text
  • http://munasimowijuxi.getenjoyment.net/60570258230.pdfIn PDF document text
  • http://lazirog.mywebcommunity.org/42748274356.pdfIn PDF document text
  • http://zisezamerares.mygamesonline.org/osteoporosis_tratamiento_natural.pdfIn PDF document text
  • http://sait-ok.ru/vurux59coy.pdfIn PDF document text
  • http://dom-bita.org/audit_engagement_risk_assessment_template7jz4u.pdfIn PDF document text
  • https://cdn.sqhk.co/jotepomi/lSUOZie/rebuilding_trust_in_a_relationship_worksheets.pdfIn PDF document text
  • http://idealslimitalia-official.site/53200063077sjwgz.pdfIn PDF document text
  • http://forkidsshop.online/the_zookeepers_wife_book_movie120us.pdfIn PDF document text
  • https://cdn.sqhk.co/dusujukakal/GUhiQuc/28794760029.pdfIn PDF document text
  • https://cdn.sqhk.co/rifojimuna/aNhd8Dt/online_photo_editor_remove_background_objects.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/5cc5389e-3aba-4278-8682-5f6fc936dcfd/21000131751.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/947d74cd-d4d0-46dc-8b8f-40d1b320ce4b/how_often_can_you_do_a_liver_gallbladder_flush.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7951e0bf-4982-4059-98fa-3f76cc88bb46/financial_peace_university_coordinator_login.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8fed7176-4818-4d45-8be7-21cb4f9cd582/keguk.pdfIn PDF document text
  • https://49b7c339-fea6-4bb3-bf7b-ca47af5263df.filesusr.com/ugd/6ca12d_98009ec86b814074b5b6c6cd3f00a299.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2f725ff7-04ce-4fd9-89fe-ffb47ebf2c71/70264413253.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ac717dc9-0eb4-4b09-a9a4-7f1cd582583d/army_cls_recertification_requirements.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/394b467b-0b4d-4cc2-89d2-ab41c4163c1e/67_lateral_thinking_puzzles.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1514cf1b-4145-40ba-8527-8585ce886099/pewerusujewalimo.pdfIn PDF document text
  • https://dc6b22d1-fd3c-476a-b8f1-b0505981f591.filesusr.com/ugd/ab5adf_4472be901aa34d3cb5f61580352c9f66.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/876cb642-88b0-4658-992a-67b2261aafd6/shortcut_key_for_taking_screenshot_in_windows_7.pdfIn PDF document text
  • http://livirava.atwebpages.com/xisovopowedatet.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.