Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://xajibur.ru/strik?utm_term=magna+carta+date+written PDF link annotation

  • http://zumewidife.mygamesonline.org/21677068550.pdfIn PDF document text
  • https://cdn.sqhk.co/womilepeba/HnhfWrA/find_the_button_mcpe_server_ip.pdfIn PDF document text
  • https://cdn.sqhk.co/tebefaravuz/gSghdjd/dome_of_doom_apk_data.pdfIn PDF document text
  • http://tuvurebomiworo.scienceontheweb.net/fivosorebimowowalovo.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/72b48d65-963c-4959-bd96-a0afd3108865/samsung_nu7100_50_inch_price_in_india.pdfIn PDF document text
  • https://64f3f273-fd79-4cea-bc15-92b2431614e2.filesusr.com/ugd/542254_4e523f79921440aa881c721f62c186ed.pdf?index=trueIn PDF document text
  • https://28a90398-13b1-4b58-b54c-ed045a6bddf2.filesusr.com/ugd/7e9e1f_f6ec2f69ad1444d2868ea7bf023d2b21.pdf?index=trueIn PDF document text
  • http://tipofib.rf.gd/how_do_i_program_my_rca_universal_remote_to_my_toshiba_tv.pdfIn PDF document text
  • http://jafigufukuwixo.rf.gd/how_to_troubleshoot_mini_split_ac_use.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d4c9487d-510e-41f8-ad55-3af7ae923a1e/assassins_creed_valhalla_transcript.pdfIn PDF document text
  • https://6196a4e6-b3b5-4a85-a139-4ec84e0a53d9.filesusr.com/ugd/d01287_d28233ca5c394cdb9b901449137072d7.pdf?index=trueIn PDF document text
  • https://cc968bdf-8a18-4a65-a72d-893c706ef441.filesusr.com/ugd/bae363_08cbfad1b68042fc9262d60636f2952d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/13e48b0e-7d06-44ec-b4de-9f1f14c44a53/harry_potter_y_la_cmara_secreta_imdb.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3b105c23-7a70-4898-b166-c8023c1ddf6a/epson_xp-200_ink.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5ad80b93-bc62-4735-99b8-36f9cbf24a7f/la_biblia_en_audio_mateo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3583a98d-fcf3-4775-be05-d2f650d032c4/how_to_learn_arabic_for_quran.pdfIn PDF document text
  • http://kapirexazi.onlinewebshop.net/meaning_of_academic_achievement.pdfIn PDF document text
  • https://69a21580-3c80-4f81-8097-1ec0bc18215d.filesusr.com/ugd/bd7df1_7e3497eb0e0f4d4e8f0da41f5d3b9ae3.pdf?index=trueIn PDF document text
  • http://kugefosames.rf.gd/baby_gate_for_stairs_with_railing_and_wall.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.