Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://seumenha.ru/award?keyword=medical+tourism+statistics+pdf PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4417426/normal_5fd2f89e41547.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4413835/normal_5ff1984c5520e.pdfIn PDF document text
  • https://cdn.sqhk.co/pudinivil/jNJ3hdv/goat_simulator_free_play_no_download.pdfIn PDF document text
  • https://cdn.sqhk.co/fapiwejagiz/kKugjb5/69482064252.pdfIn PDF document text
  • https://cdn.sqhk.co/tugirujozi/chjqhg6/25201800815.pdfIn PDF document text
  • https://cdn.sqhk.co/pajijolabalu/geMikij/numerical_mathematical_analysis.pdfIn PDF document text
  • https://cdn.sqhk.co/wukikanas/hdFeczm/duwoxukebekin.pdfIn PDF document text
  • https://cdn.sqhk.co/pibilebomek/pjdQfgc/detavitofu.pdfIn PDF document text
  • https://cdn.sqhk.co/pisapaxosabo/fhiHggz/rupapowigexazokobifo.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4372735/normal_6016af3271055.pdfIn PDF document text
  • https://cdn.sqhk.co/begokaxawip/nNjaBi1/zenexas.pdfIn PDF document text
  • https://cdn.sqhk.co/tisezalave/SlShaG5/67395372777.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4386607/normal_603a4f4b48a97.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://5ce19dfa-329f-495d-88d1-e1e7834d9072.filesusr.com/ugd/d902bb_8d5235f932bb4ad1ab80efdaf41f44c9.pdf?index=trueIn PDF document text
  • https://8ecf7690-1f99-4e28-a4b6-3228ba9731d7.filesusr.com/ugd/63d3ad_7664854770964e039544f7325cdba602.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/tesodagiwor/my_talking_angela_mod_apk_all_unlocked.pdfIn PDF document text
  • https://51956041-da35-40aa-96c1-085c1f47c80d.filesusr.com/ugd/e6e573_9e3bcad721a34890878a24a489a753d0.pdf?index=trueIn PDF document text
  • https://7292b199-6d7c-4e84-b646-7854114497ba.filesusr.com/ugd/53361e_2305792976c94dfb97b112c206c54672.pdf?index=trueIn PDF document text
  • https://e0271a52-a7af-48e9-8a99-924ce320ec62.filesusr.com/ugd/be5703_70bfc6b3a2374dceac79bcc57bacd2d5.pdf?index=trueIn PDF document text
  • https://cb38ef3f-1f2c-4622-8962-dca261660167.filesusr.com/ugd/3ae201_668efda2e1a04357ba62b9f88cdb8005.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/padadutiseni/damez.pdfIn PDF document text
  • https://e61e9f85-32c5-4861-9fd4-b89109084c35.filesusr.com/ugd/2e4eb4_2f9b99cbbc264c33a6d0a63fafb57b11.pdf?index=trueIn PDF document text
  • https://d4e9107b-ea7a-46dd-9434-10729a3140ee.filesusr.com/ugd/2e3df4_4157bd82ca3a4902a6da678a3c02cacf.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/nuselufuzo/best_free_android_app_sites.pdfIn PDF document text
  • https://f05e0dbb-21cf-40ea-8b71-00b8d6f49a3b.filesusr.com/ugd/b09e1d_6a191b87d38542dbb4c9cd36b61b7cb3.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.