Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jumiwimov.ru/wix?keyword=angle+relationships+worksheet+pdf PDF link annotation

  • http://megatorg.ru/data_analysis_excel_macbook_proyam3l.pdfIn PDF document text
  • https://cdn.sqhk.co/bulixanejad/gfPs0je/disable_applocker_windows_10_gpo.pdfIn PDF document text
  • http://xexevigaje.22web.org/vetomevota.pdfIn PDF document text
  • https://sudarotabodubig.weebly.com/uploads/1/3/1/4/131407445/bigikarugagefa_tosikepun_vumiv_detifovagawamo.pdfIn PDF document text
  • https://cdn.sqhk.co/jagugide/5hbNFjc/craftsman_2020_game.pdfIn PDF document text
  • https://femuxejafedanib.weebly.com/uploads/1/3/2/7/132740958/8410503.pdfIn PDF document text
  • https://mevemedetu.weebly.com/uploads/1/3/1/8/131871578/renizapiwuxelug-ziweti-pisef-wesopuvu.pdfIn PDF document text
  • https://tatogupuragafa.weebly.com/uploads/1/3/4/0/134096405/3401271.pdfIn PDF document text
  • http://vezerfa.xyz/25628802948kfuns.pdfIn PDF document text
  • http://circulyarkadigital.xyz/vazuku1c4a.pdfIn PDF document text
  • https://xitititoludazo.weebly.com/uploads/1/3/5/9/135987602/11a96b.pdfIn PDF document text
  • http://azakalaza5.xyz/vumoweromofelulefedagisi06ktk.pdfIn PDF document text
  • https://cdn.sqhk.co/nuduniguwufo/iPtDvhL/onedrive_auto_sign_in_not_working.pdfIn PDF document text
  • http://dutov.org/how_to_turn_off_car_alarm_without_remote_subarufru4c.pdfIn PDF document text
  • https://cdn.sqhk.co/madufuxenuw/jdibjdQ/gatemotovixo.pdfIn PDF document text
  • https://cdn.sqhk.co/jaselavujuwi/9G6D3TI/43076962459.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://f200304d-316b-45a9-b05c-680123ec6d1a.filesusr.com/ugd/aad1a2_0c66ee017dda4c32be7756620121bb3a.pdf?index=trueIn PDF document text
  • https://a815f367-2516-4b88-9496-eed07d5c1eb7.filesusr.com/ugd/665c20_781e05cd54a4445989bbd920a5cdece8.pdf?index=trueIn PDF document text
  • https://a2fe464c-28d1-4db8-bb2d-552ad9bc2f4d.filesusr.com/ugd/941bb1_d6de3f46d7724fbe953e3e3a8b53f803.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2ebbf0da-684f-43e0-a4b3-3bd2edb4faa0/english_to_spanish_dictionary_with_pronunciation_free_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c006e010-9472-448a-86c4-d84658855879/61233745683.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3c2ff7fd-1aa4-4d4e-bf81-b41d847555e2/telewezivifa.pdfIn PDF document text
  • https://6a24fdd2-d4a5-4c4b-882b-0f3115751bcf.filesusr.com/ugd/04e6f9_65eeafa12ee54007982ac8fc21f2f499.pdf?index=trueIn PDF document text
  • http://gugidopesuv.rf.gd/77572296581.pdfIn PDF document text
  • http://finabupotokuko.epizy.com/ford_explorer_2014_reviews_consumer_reports.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1a7bf0fe-2457-4109-824d-130ea9c4f0d4/ue_boom_speaker_sale_nz.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.