Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://midufefew.ru/strik?utm_term=identifying+simple+compound+and+complex+sentences+worksheet+pdf PDF link annotation

  • https://cdn.sqhk.co/jarixizotib/RgfCwww/tunnel_town_kc.pdfIn PDF document text
  • https://cdn.sqhk.co/zepigelona/hcGbchb/the_legacy_2000.pdfIn PDF document text
  • https://cdn.sqhk.co/durotula/raYgeic/beliranip.pdfIn PDF document text
  • https://cdn.sqhk.co/zosaremarebi/e4thigj/sale_on_etsy_or_ebay_uk_cars.pdfIn PDF document text
  • https://cdn.sqhk.co/virurewev/ji4M8Hb/77457221746.pdfIn PDF document text
  • https://cdn.sqhk.co/xijisejes/dDicegf/moto_rider_go_highway_traffic_game_download.pdfIn PDF document text
  • https://cdn.sqhk.co/povuguzuloga/idieq8J/target_shooting_games_unblocked.pdfIn PDF document text
  • https://cdn.sqhk.co/fezavomol/pU6QLhi/sugajulakatusu.pdfIn PDF document text
  • http://xazivigufimu.22web.org/epi_info_7_user_guide.pdfIn PDF document text
  • https://cdn.sqhk.co/wezokobuli/fjDiisI/80792763259.pdfIn PDF document text
  • https://cdn.sqhk.co/posukomokufi/3v7ChfD/assessment_in_education_quotes.pdfIn PDF document text
  • https://cdn.sqhk.co/welosezu/cUjg0jg/dabofikaveloko.pdfIn PDF document text
  • https://cdn.sqhk.co/tajudozizif/xGhepha/oconomowoc_library_curbside_pickup.pdfIn PDF document text
  • http://jirazabewofi.22web.org/what_is_a_literature_review_in_a_research_paper.pdfIn PDF document text
  • https://cdn.sqhk.co/xolafunodo/egejjig/homeroom_to_go_phone_number.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/8f9f1eb9-d91d-4afb-8bb8-b5836c928027/how_to_winterize_a_camper_water_heater.pdfIn PDF document text
  • https://ca6b24e6-01cd-4368-a310-1df05077a315.filesusr.com/ugd/11b39a_8261e93b3a3c408fba36095d0fb5de85.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/6e5158e6-e3cc-46bc-83dd-40730972bdc3/lopowixavufaziwuxenub.pdfIn PDF document text
  • https://a86a6b26-b473-4b55-b9aa-7628a2bff077.filesusr.com/ugd/4f270c_6dc939a1d33f41b2b095d074c9cd529f.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/1d2eaec4-79d1-4e2f-9024-17bf8170cfe6/is_a_2000_watt_generator_enough.pdfIn PDF document text
  • https://ef90beaa-bca2-431e-862c-49c19dd94618.filesusr.com/ugd/06497e_6430fcdd154d495a91a2e7dd0f437268.pdf?index=trueIn PDF document text
  • http://magonusu.epizy.com/hp_laserjet_pro_m12a_datasheet.pdfIn PDF document text
  • http://togalufunepobaz.rf.gd/70645876775.pdfIn PDF document text
  • https://cae2aa39-5014-47ec-b549-0fed73f36d02.filesusr.com/ugd/c8683e_44a2589cfb5d4ac3ae621222517fe912.pdf?index=trueIn PDF document text
  • http://xovijoj.epizy.com/74809086575.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e85f24b7-b8ec-469e-a2c6-8abab1b2c787/gemunolo.pdfIn PDF document text
  • https://790985df-dfec-4a08-b509-00f37668cf87.filesusr.com/ugd/a421e3_88fd2f15ffe34b4c92172e46b467ee77.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.