Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://xajibur.ru/award?keyword=carmine+caruso+musical+calisthenics+for+brass+pdf PDF link annotation

  • http://salizurewaki.mypressonline.com/norma_asme_y14._5.pdfIn PDF document text
  • http://xawinewilapirog.iblogger.org/100_dollar_startup_book_summary.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/73c4472e-c487-446d-97ca-565ae400a5e3/what_happens_to_brenda_in_the_maze_runner.pdfIn PDF document text
  • http://sukokovevaz.atwebpages.com/tovebiripotage.pdfIn PDF document text
  • https://2559d30b-64cd-4b4d-aaad-e76a675dde99.filesusr.com/ugd/f5a024_bbc378899cca4c14a57b921f67814a3e.pdf?index=trueIn PDF document text
  • https://770ad53b-b55e-4e58-b1eb-3709f41304f7.filesusr.com/ugd/98e298_bc95b93adb9e45b1969d9c4ee0b75fbd.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/1c273696-fb8b-4249-bd21-eb977959909e/las_parabolas_de_jesus_para_nios_de_primaria.pdfIn PDF document text
  • http://solezujufor.rf.gd/friction_worksheets_for_3rd_grade.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/286b25ec-73e1-4a8a-9ebc-2d909faff3fe/61359048716.pdfIn PDF document text
  • https://0e8f88b9-656e-4b05-9cd8-8bd477f85547.filesusr.com/ugd/95b9ea_a43638b4fd0f432e88a6fd6913e3858e.pdf?index=trueIn PDF document text
  • https://b8f7bc2e-5f90-466c-a76c-b8215bfdb3ae.filesusr.com/ugd/9717d9_6cc0f43193e348ea97c3bdaa5baebeed.pdf?index=trueIn PDF document text
  • http://jilerixam.epizy.com/61411260517.pdfIn PDF document text
  • http://puriruf.epizy.com/access_database_training.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/19a36e8f-6f9d-47d5-bfca-830183e38717/gukifozalogenizokebuwo.pdfIn PDF document text
  • https://s3.amazonaws.com/mojivikapeti/how_much_does_it_cost_to_produce_one_episode_of_a_tv_show.pdfIn PDF document text
  • https://s3.amazonaws.com/gixirojozogufux/kivavilexavimoran.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fcce050e-5849-46bc-87b3-2d81a076d51e/57250325822.pdfIn PDF document text
  • https://67a4337f-2b79-4d04-9c1d-2578c80f4945.filesusr.com/ugd/964009_961a8f2c8bc04b1892f48b7843fecf66.pdf?index=trueIn PDF document text
  • https://ba10d46a-d7c1-43af-8542-f1a50f31aa8a.filesusr.com/ugd/4dded2_13f7bf88da93479d84e88113a392bd93.pdf?index=trueIn PDF document text
  • http://vabanenutulaki.rf.gd/elastic_heart_sia_piano_sheet_music.pdfIn PDF document text
  • https://02687da8-bf2b-436b-a8ca-82c6e04513a5.filesusr.com/ugd/e48f8a_178ba4c8e3af44cfaab789c27374db50.pdf?index=trueIn PDF document text
  • https://438e95ed-c264-4db5-88d3-1a9ca8b91b86.filesusr.com/ugd/733c1f_685b593a0079476dbf7a3c9ab65195fd.pdf?index=trueIn PDF document text
  • https://229c3593-bb94-4e5d-9b9f-ca3747df48ef.filesusr.com/ugd/145364_1931f024bb4440e78306a4055b940fa9.pdf?index=trueIn PDF document text
  • https://a0a5ada1-270c-452f-b092-d943fc6f0dc0.filesusr.com/ugd/306762_41f4778f024e49b1996496ee657da380.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.