Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dugedepap.ru/strik?utm_term=full+metal+jacket+intro PDF link annotation

  • http://skywonder.space/shout_into_the_void_meaning_in_urdu84e41.pdfIn PDF document text
  • https://cdn.sqhk.co/merojuniv/wISjgjh/dragy_10hz_gps_based_performance_meter.pdfIn PDF document text
  • http://geesecam.com/advanced_engineering_mathematics_by_ka_stroudt5iw1.pdfIn PDF document text
  • http://igcopyrightclient.com/short_film_script_writingork4d.pdfIn PDF document text
  • https://cdn.sqhk.co/ribafesupuro/ehitEge/69002521672.pdfIn PDF document text
  • https://cdn.sqhk.co/rudolikube/gdjcrkg/military_sounds_of_silence.pdfIn PDF document text
  • http://ruxuzosok.mywebcommunity.org/aium_fetal_echo.pdfIn PDF document text
  • http://cmbclientes.com/zebavipobujokixaouui5.pdfIn PDF document text
  • https://cdn.sqhk.co/rujiwujik/igjDssX/ticket_to_ride_first_journey_game_review.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://a1c9bafd-2917-4c1b-b79c-a4b44a941470.filesusr.com/ugd/f0f215_95efcc2e9c1e4f5b9c586df823669e61.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/kotodur/79489130186.pdfIn PDF document text
  • http://nufulavidibime.myartsonline.com/pajavibetewumetij.pdfIn PDF document text
  • https://b595a6f9-6bcb-48d8-acfc-7cb8c696cf55.filesusr.com/ugd/21f311_519c15779339420b905c361765e42ad3.pdf?index=trueIn PDF document text
  • http://vedixemalirugi.atwebpages.com/bsc_agriculture_syllabus_2020.pdfIn PDF document text
  • https://93dbb2ad-f1e8-4c6c-adfd-2ef134399473.filesusr.com/ugd/df4650_d255599ad8954268a81e29289a1e2b7a.pdf?index=trueIn PDF document text
  • https://acfc0e76-311d-46af-9c13-f46c112eb424.filesusr.com/ugd/f90bad_8dd3cd20eca741b497b52e29f0de19d2.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/gapivegek/jobs_at_kung_fu_tea.pdfIn PDF document text
  • http://zirutabu.myartsonline.com/snake_venom_types.pdfIn PDF document text
  • https://24a70dd4-b549-4b9e-9c0a-6eea45ab85ad.filesusr.com/ugd/ab0c63_9280a7d0555344a3ab7f3466cbd7f734.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/wovugi/how_to_renew_your_cpr_certification_online.pdfIn PDF document text
  • https://cd8fad78-6a19-43c6-878c-830d169ee42d.filesusr.com/ugd/ff0d91_fd054177d98948e29f53c58ee81818b5.pdf?index=trueIn PDF document text
  • https://790985df-dfec-4a08-b509-00f37668cf87.filesusr.com/ugd/a421e3_a6e9687f4e714fa19b539897323b6dbf.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/kulinisokakewi/fopapimogokafev.pdfIn PDF document text
  • https://cb2d4818-2134-4ea5-ae57-1bc45cfc4292.filesusr.com/ugd/7e787c_0abc82cfeb3946ae842a9645ca94da82.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.