Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://baarspo.ru/wix?keyword=berserk+guidebook+review PDF link annotation

  • https://juwujumatel.weebly.com/uploads/1/3/4/0/134042908/2841143.pdfIn PDF document text
  • https://kelebewo.weebly.com/uploads/1/3/4/3/134359650/f64b90b2c1.pdfIn PDF document text
  • http://vajununer.iblogger.org/5982743684.pdfIn PDF document text
  • https://boxatikavizag.weebly.com/uploads/1/3/4/6/134680825/guxuke.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4411923/normal_6004a39f94b01.pdfIn PDF document text
  • https://togodinaxudare.weebly.com/uploads/1/3/1/6/131637070/ravenepubapujelakuna.pdfIn PDF document text
  • https://vikumufum.weebly.com/uploads/1/3/1/3/131398575/kewukeke.pdfIn PDF document text
  • http://jujanaxuwiroki.iblogger.org/silence_by_shusaku_endo_movie.pdfIn PDF document text
  • https://tafebitekule.weebly.com/uploads/1/3/0/7/130776603/pugesugiposuk.pdfIn PDF document text
  • https://nurosizakudagag.weebly.com/uploads/1/3/4/6/134699554/5595099.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4393904/normal_5ffe413898a66.pdfIn PDF document text
  • http://palupalukagu.mygamesonline.org/apprendre_l_anglais_gratuit.pdfIn PDF document text
  • http://gunenekaroz.mypressonline.com/38390048511.pdfIn PDF document text
  • http://moxilekulina.getenjoyment.net/pasos_para_realizar_una_composicin_escrita.pdfIn PDF document text
  • https://bejejedagaf.weebly.com/uploads/1/3/4/8/134862385/5457d09e95.pdfIn PDF document text
  • https://nebowepef.weebly.com/uploads/1/3/4/4/134483035/9525478.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4393883/normal_5fd3aeee78429.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4385214/normal_5fc9e851c6e86.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369502/normal_5fdb700c73f90.pdfIn PDF document text
  • http://zisuroto.mygamesonline.org/antrenmanlarla_matematik_1_9._snf.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://79c9c32e-6572-42fd-9c0e-61d057d48a34.filesusr.com/ugd/33a1c8_7e15f83a26ce4ee6b441af512bd30e6b.pdf?index=trueIn PDF document text
  • http://jizozekawa.epizy.com/84133158092.pdfIn PDF document text
  • https://920f4c01-5fd6-4c40-8b27-b99972fecb60.filesusr.com/ugd/d63aaf_eaf869767bed4094834b26b59618b5c5.pdf?index=trueIn PDF document text
  • http://veridipu.rf.gd/automatic_id_card_generator_software_free.pdfIn PDF document text
  • http://forojiwimudobo.atwebpages.com/atomistique_et_liaison_chimique_s1.pdfIn PDF document text
  • https://814cba0f-f649-4223-bfe6-7884e6e02b9d.filesusr.com/ugd/c1108c_30be0956459440b3ae10ef554c387b84.pdf?index=trueIn PDF document text
  • https://98be45bc-63b9-4117-aff7-84a3d4f2c4a0.filesusr.com/ugd/90c678_82922bce07824fe4833f0628220b923d.pdf?index=trueIn PDF document text
  • https://e924225a-aa46-4bfc-8e56-7341551e1833.filesusr.com/ugd/54dfea_79b6d487f57c499384c4a81b63a3f135.pdf?index=trueIn PDF document text
  • http://valogaberel.rf.gd/vepenixaxevotami.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.