Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://kuzutuzo.ru/strik?utm_term=how+to+fix+primo+cold+water+dispenser PDF link annotation

  • http://dnepr24.info/38833334469cwm8z.pdfIn PDF document text
  • https://cdn.sqhk.co/xubupigegi/ghfhb8S/word_search_puzzles_printable.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369508/normal_606200cb14f58.pdfIn PDF document text
  • https://cdn.sqhk.co/madufuxenuw/5haiggg/navneet_books_online_price.pdfIn PDF document text
  • http://konsalting.info/9264431515tz561.pdfIn PDF document text
  • http://xenakasewexibal.sportsontheweb.net/alrededor_de_tu_mesa_partitura.pdfIn PDF document text
  • http://lixodamevurobar.mygamesonline.org/kalimba_manual.pdfIn PDF document text
  • http://dfwshootersupply.com/calheta_beach_i_madeira_portugalp2u14.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4488103/normal_6011dd8969081.pdfIn PDF document text
  • http://icily.xyz/org_chart_template_free_excelatokj.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4384644/normal_6034cfee5d5ee.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4420230/normal_6056534cebed8.pdfIn PDF document text
  • https://cdn.sqhk.co/lowanivari/dibHTji/minecraft_bedwars_map_free.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4447079/normal_603e63c3e2a21.pdfIn PDF document text
  • https://cdn.sqhk.co/kixarozikej/jdMIQa8/technology_in_higher_education_essay.pdfIn PDF document text
  • http://ca-manalapan.space/327876858611ur40.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://7c3dd69e-6649-485e-b385-36acc2971cd6.filesusr.com/ugd/cf9ff1_983f42949ffd4e8cbb0f720a03274ec6.pdf?index=trueIn PDF document text
  • https://dc383e6d-b7a3-4e67-a88a-227fa542b6c3.filesusr.com/ugd/72b0e7_33bfaeccda2f4fe3b723a304b161b85f.pdf?index=trueIn PDF document text
  • https://64e18f06-8a0e-4dc1-8427-9dd81b4bff36.filesusr.com/ugd/baa514_27adc202fe2548efb5d17e71a7482453.pdf?index=trueIn PDF document text
  • https://80b1f93a-fe74-4439-a81d-34814fa7a505.filesusr.com/ugd/e56fe2_30a542c1a1ca4ce7afb17b235c303ede.pdf?index=trueIn PDF document text
  • https://abc5f1b3-ad37-4660-b048-d9bff2240d70.filesusr.com/ugd/a1fb68_e90ad2d46ad14b1c9828a19e4375eba6.pdf?index=trueIn PDF document text
  • https://790985df-dfec-4a08-b509-00f37668cf87.filesusr.com/ugd/a421e3_a2b2d7f31b84484cbefea340dac1a40e.pdf?index=trueIn PDF document text
  • http://nosawakudik.myartsonline.com/writing_algebraic_equations_from_word_problems.pdfIn PDF document text
  • https://dc010c70-835d-4b56-8cb0-1e1bda7cab64.filesusr.com/ugd/fb576b_ae5da18809bc4bbd9d830bf7d1bb0c8b.pdf?index=trueIn PDF document text
  • https://f5d5bca3-0ffd-41e3-a77d-3d805a1e43e5.filesusr.com/ugd/4e23ca_ba63d2c4949c471c91b3f7df8ae5988e.pdf?index=trueIn PDF document text
  • https://2f60c0de-bae8-48d8-8f3f-ce7907f87c52.filesusr.com/ugd/badafb_768600abe27b491f91cbb7db95dbbb02.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.