Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jottigo.ru/award?keyword=basic+calculus+grade+11+module+pdf PDF link annotation

  • https://static.s123-cdn-static.com/uploads/4476756/normal_5fc5cbde1216c.pdfIn PDF document text
  • http://pubggaming.online/sloth_goonies_memeepxw0.pdfIn PDF document text
  • https://cdn.sqhk.co/fujonexa/bPwxig0/slick_slime_sam_barbie_doll_clothes.pdfIn PDF document text
  • https://cdn.sqhk.co/masunidupag/miejchi/spiderman_finger_guns_meme.pdfIn PDF document text
  • https://cdn.sqhk.co/lixozimiz/f1ifhf9/gilozonapapawomujejapawe.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4423780/normal_6042c6c990910.pdfIn PDF document text
  • http://pop-marketplace.ru/13982086507waqc1.pdfIn PDF document text
  • https://cdn.sqhk.co/wazilisiko/jhAhfhj/space_flight_games_online.pdfIn PDF document text
  • http://goodsfor.life/xezimumexowasinatuzazhlle.pdfIn PDF document text
  • http://theandyhong.com/14045030032481y7.pdfIn PDF document text
  • https://cdn.sqhk.co/muwazubivotu/b9jdhb2/gabigepo.pdfIn PDF document text
  • http://lnstagramverificationbadge.com/java_8_update_45_mac_os_x_downloadn2iei.pdfIn PDF document text
  • http://it50disconto.info/what_chapter_in_after_we_fell_does_tessa_get_drugged0s1s9.pdfIn PDF document text
  • http://belkwigs.com/meaning_of_academic_performance_according_to5510m.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://ff4d9611-e7ea-45f2-85d3-f0b464ef817f.filesusr.com/ugd/48f461_cfe6facdaf7141a2a6dd4a743a975e65.pdf?index=trueIn PDF document text
  • https://de2a8dfc-dc8d-4d62-be3b-f97abdd17bf6.filesusr.com/ugd/c722c2_00d1afa08a4140c0963c969f9e74dd8e.pdf?index=trueIn PDF document text
  • https://a5a8f6e1-24ae-425c-880d-6f4079e3c376.filesusr.com/ugd/035627_feda6001b79543dfb01d95c0812421ee.pdf?index=trueIn PDF document text
  • https://76df98a8-3e94-4eee-a6f5-23e1de06049b.filesusr.com/ugd/54c74c_09cdcf2eca164af8889314868b73fc68.pdf?index=trueIn PDF document text
  • https://ce55c564-0e79-48ac-bd91-a034cff8554b.filesusr.com/ugd/bd1fc0_a171b6797a65451f9ab769285d1b809c.pdf?index=trueIn PDF document text
  • https://a50dbba5-e4fd-40cc-afa9-a45495a5accf.filesusr.com/ugd/7f929b_c06435ca1d1449e9906183c068621e60.pdf?index=trueIn PDF document text
  • https://fdb4f28e-c637-431f-967d-457feef73efb.filesusr.com/ugd/cf5aa9_d68ce8421e67470c8877118f8ab546e7.pdf?index=trueIn PDF document text
  • https://ef733714-782c-48ea-8991-1bc0bf0c95f2.filesusr.com/ugd/ad2ade_c3ace822ce784108a5da765b4ef8ee90.pdf?index=trueIn PDF document text
  • https://5548a280-a194-4776-8019-0e256783c1fa.filesusr.com/ugd/f2c1dc_087b9cc22c10401096b37035b8e51768.pdf?index=trueIn PDF document text
  • https://ac3db616-04cb-40f1-8357-c67041f5e20c.filesusr.com/ugd/eda9ba_9873d7fcd6e6468fac9e9835db21232e.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.