Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://zajinet.ru/strik?utm_term=medea+euripides+pdf+gredos PDF link annotation

  • http://betawajapasex.22web.org/tutujugifotiribofe.pdfIn PDF document text
  • http://whowill.ru/58102894351c4a7q.pdfIn PDF document text
  • http://zdsshop.top/kugugewimifuxesilamafebugmuehg.pdfIn PDF document text
  • http://rejonanujezeke.22web.org/captain_underpants_books_set_uk.pdfIn PDF document text
  • http://mavitrade.com/24279933062drrei.pdfIn PDF document text
  • http://nowtorrentz.com/fitbit_flex_2_charger_amazoncrbj0.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://3ae4d138-4ba3-4962-98fb-1b98b40a6a82.filesusr.com/ugd/38062a_447d346210ca475f855a352c23061aa8.pdf?index=trueIn PDF document text
  • https://ed36ca5d-e6e9-4caf-8bbb-3a8af5cfee16.filesusr.com/ugd/971556_618a1877fbaa41a3b975930578175069.pdf?index=trueIn PDF document text
  • https://3edbbcf3-b5b1-446e-9630-835d38fa79e0.filesusr.com/ugd/6908d7_48b17998f33f4f2499547e1e3157f996.pdf?index=trueIn PDF document text
  • http://vanuzavabew.epizy.com/23820856042.pdfIn PDF document text
  • https://ff87c8b5-ca28-4ac0-94ba-218234037d87.filesusr.com/ugd/1d4e4f_f236f082d32f4ce28412cdf2c47fe1fc.pdf?index=trueIn PDF document text
  • https://543e2b4d-9699-46d2-9656-875e860b8e63.filesusr.com/ugd/fb32d0_5b91cae0feb346f48e379bda22d4cc3e.pdf?index=trueIn PDF document text
  • https://d52aed46-be45-4f9b-8106-cf6fc7ee66c0.filesusr.com/ugd/b148e5_996d648e290a4658a13a2dfd028c3512.pdf?index=trueIn PDF document text
  • http://namajuve.epizy.com/75632527646.pdfIn PDF document text
  • https://75cc4b12-69da-4024-8422-75f9303faa99.filesusr.com/ugd/d6c222_e581d13d621e4f17939c7e827898f191.pdf?index=trueIn PDF document text
  • https://18bc7be3-897e-46c1-a475-efc190d089bd.filesusr.com/ugd/62845f_b7bfa186b98540f99ac97de80a72df68.pdf?index=trueIn PDF document text
  • http://bosadubarelazu.rf.gd/88857133378.pdfIn PDF document text
  • https://6f672a44-e16c-4921-a0f1-e3781c0647c5.filesusr.com/ugd/bda22a_45d98c63bfd547fc8fc244468ab5f536.pdf?index=trueIn PDF document text
  • https://ab60d57a-1f92-408f-9079-0b325776b613.filesusr.com/ugd/724fb5_907c56ec142c4c168cb16057e57fa9a3.pdf?index=trueIn PDF document text
  • https://7aff118d-26f6-4d76-9bc9-1838009e7274.filesusr.com/ugd/f80014_8a42d83ac278422d9b38a8366728805f.pdf?index=trueIn PDF document text
  • https://95043331-d9de-4498-ad98-35b8ac3ee23f.filesusr.com/ugd/5740b2_ff21ed6c1f984e2d8e286805937eece7.pdf?index=trueIn PDF document text
  • https://47e4df30-8702-49a4-8bd5-327e1546ff06.filesusr.com/ugd/379272_e713adf5e7654e299cfa82e1389a9be4.pdf?index=trueIn PDF document text
  • https://9d1e48ad-bcd7-4831-9b7b-7108443a63b6.filesusr.com/ugd/136d07_7fbd3b4185f1406a9698232806d4cbd9.pdf?index=trueIn PDF document text
  • https://ef9d90ca-5811-4a1c-810e-75bcfae60121.filesusr.com/ugd/a33af7_6f4d444799ed49fcbfc28445c84ad580.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.