Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ponafet.ru/strik?utm_term=algebra+de+baldor+caso+6+de+factorizacion PDF link annotation

  • http://aarbuz.space/82507606030ujdzg.pdfIn PDF document text
  • http://fbcopyright-center.com/lanelayd49l.pdfIn PDF document text
  • http://reestr.site/artculos_de_la_constitucin_mexicana_que_hablan_sobre_la_saludlal07.pdfIn PDF document text
  • http://vanlit.ru/gagijekujosenemukawokupel7ro8w.pdfIn PDF document text
  • http://puwobero.22web.org/why_is_my_mercury_optimax_beeping.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://f815f12b-539f-4060-8ed9-abd2caada31b.filesusr.com/ugd/ceb2e8_be87fe916e73415e978e351481aab6d2.pdf?index=trueIn PDF document text
  • https://73af689e-4c80-4f62-99d3-7a886641ad81.filesusr.com/ugd/3b5dd9_e3fe1c227b4a490f80cd660b8c7e4c6a.pdf?index=trueIn PDF document text
  • https://01c19f78-c7d0-441a-b56a-8672493f87de.filesusr.com/ugd/9d66c7_bf01c37c5f0f47df894222ef075892de.pdf?index=trueIn PDF document text
  • https://a4067306-84c0-45ce-9c36-3cbb795fcb37.filesusr.com/ugd/d5b970_02d0880f8db944b18b689bc4f0332395.pdf?index=trueIn PDF document text
  • https://0503187d-52cd-4237-9521-a3cb9bf551ae.filesusr.com/ugd/5bb01c_5530343fe2e043679f0faf1167872853.pdf?index=trueIn PDF document text
  • https://c931c956-7f53-4e4e-96dc-27d7f003ba63.filesusr.com/ugd/b80c10_dc2d99b2ef324eb1b963baf8f8710fbb.pdf?index=trueIn PDF document text
  • https://6d4cd3b7-91e9-43ac-92b9-205473f1e50d.filesusr.com/ugd/28146e_c40e7ccaa1d240889fca7a08014ecf0a.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/sezebepit/96619431136.pdfIn PDF document text
  • http://fedasumenusum.rf.gd/dr_andreas_moritz_books.pdfIn PDF document text
  • https://s3.amazonaws.com/kukazowox/48897113044.pdfIn PDF document text
  • http://fugawinovijes.epizy.com/lagu_ajarku_mengerti_jalanmu.pdfIn PDF document text
  • https://d1b33a7b-cde1-45d4-bc15-d4d3b6236ac5.filesusr.com/ugd/1d64af_06a98460e0814516b6767f32d83d189d.pdf?index=trueIn PDF document text
  • https://c6506652-bf5e-4f52-be36-03dbfaede22c.filesusr.com/ugd/f74919_c15e5c9483f1470eb5e32f3962300f6d.pdf?index=trueIn PDF document text
  • http://potovoz.rf.gd/jermaine_kearse_injury_report.pdfIn PDF document text
  • http://folalolitawos.epizy.com/7763397488.pdfIn PDF document text
  • https://a29d81ee-e589-4368-99bd-4e0be04eb4c0.filesusr.com/ugd/a89e6e_63d2b7cb6a8c4eb4ada609e0c1fc105c.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/fapaga/najoni.pdfIn PDF document text
  • https://32dbe310-3310-44a7-9745-c5428e90421e.filesusr.com/ugd/e3c460_5eb05b6f88364cb281d6a627917fb00c.pdf?index=trueIn PDF document text
  • https://58f604bd-1fd8-4cfe-af9b-f15e67d030d5.filesusr.com/ugd/9a7439_8015baf2f54f4ed583bfcced153a5fb3.pdf?index=trueIn PDF document text
  • https://9f53eded-325d-4e02-8430-7c09bd872488.filesusr.com/ugd/e04405_f1e14e5247fc47319d73ab40b2f1961a.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.