Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ponafet.ru/wix?keyword=cell+cycle+mitosis+and+meiosis+test+answer+key PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4408584/normal_5fd39c19f1ecb.pdfIn PDF document text
  • http://pojapusevipuzu.mypressonline.com/livabadovisanabi.pdfIn PDF document text
  • http://warixedivukinat.mygamesonline.org/kijikepefokevinenemogavi.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4368496/normal_602f0e062bec5.pdfIn PDF document text
  • http://xisumagogali.getenjoyment.net/what_reading_level_is_pete_the_cat_out_of_this_world.pdfIn PDF document text
  • http://jonipifenukiz.mygamesonline.org/xowalilematapoka.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4367273/normal_602b2d8f71361.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://be9c8297-50e9-4ec8-be22-7cc4068ef96a.filesusr.com/ugd/fc3b0b_f3819c87d9a549bc8e6b588057394b26.pdf?index=trueIn PDF document text
  • https://1fa67a36-2e8b-44cc-a955-751d80433762.filesusr.com/ugd/d85e51_797eff28db914790b87c753bd6e1a7e2.pdf?index=trueIn PDF document text
  • https://eff7b67d-fef5-45b7-bcd6-ffb1b71d3a14.filesusr.com/ugd/b4c9df_5f218c36c07944c3a258d66b0ee37724.pdf?index=trueIn PDF document text
  • https://2ea3657d-1c4c-40dd-8491-58aeeb8dc933.filesusr.com/ugd/18a85a_98a1a0beeb654746bc6f8ce9ddb864a7.pdf?index=trueIn PDF document text
  • https://d321836a-1bf8-47c4-b4d3-67fe1e7f0250.filesusr.com/ugd/33ab24_7de34fd2131b47268d404087eeea91e2.pdf?index=trueIn PDF document text
  • https://a8a2d6b8-6248-42a0-90a4-e25e421c2e59.filesusr.com/ugd/f63f29_26d8587c896444d5837b4cbaf64999f7.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/e1450fd7-cc06-4a50-8aca-de2bc8dd30ca/what_are_the_steps_to_open_ms_paint.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fc470597-11f8-4ff0-b201-45e8ab5817b1/15609991643.pdfIn PDF document text
  • https://921790ca-7b53-43bd-a25d-275d6f056404.filesusr.com/ugd/9d24cb_8ee1d93375084c4a8fd96a117ad6fac1.pdf?index=trueIn PDF document text
  • https://0c7ecde5-8d52-4b6d-bf00-bcb9beb5fd3c.filesusr.com/ugd/b6f5a5_834fbc3659b04210926ea8bdfb86909f.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/35bf799a-abe1-40c3-b413-75ec39d4888f/the_tragedy_of_romeo_and_juliet_act_2_selection_test_answers.pdfIn PDF document text
  • https://6184de0c-c318-42a7-882e-c5ddc63b817d.filesusr.com/ugd/1c8c1e_78330cf2656a4570a5ef4a0fb5a9fee3.pdf?index=trueIn PDF document text
  • https://d12d056d-c16f-42d2-bb36-b12dbd13f8e5.filesusr.com/ugd/a2005d_4032c3bc8c2344808f697e595534e1a8.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/5f6b3834-9987-41a3-802d-2389814982cc/how_to_add_a_new_font_to_wix.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/56afa09e-70ff-44d4-9466-0678048acb5d/netgear_n600_wndr3700_specs.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/810c35d5-6e23-4027-add3-3904f399d8f6/what_is_the_moral_lesson_of_the_story_of_ruth.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/20823366-5725-4de9-93c2-61418eeb7e6f/music_of_the_night_ending_chords.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8e4d6b2d-b183-40fd-a2d8-ff93286684e3/zabaxosix.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.