Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ponafet.ru/award?keyword=mathematical+excursions+aufmann+pdf+free+download PDF link annotation

  • https://cdn.sqhk.co/gufojakig/ehaOJFu/chennai_super_kings_photos_dhoni.pdfIn PDF document text
  • https://xigujevaw.weebly.com/uploads/1/3/4/7/134701692/5843343.pdfIn PDF document text
  • https://cdn.sqhk.co/kibedutej/jejhIgi/within_movie_2016_ending.pdfIn PDF document text
  • http://znakomstva69.space/minn_kota_power_drive_v2_45qi2hd.pdfIn PDF document text
  • https://cdn.sqhk.co/paparidew/igdggje/tik_tok_all_music_ringtone_download_mp3.pdfIn PDF document text
  • https://goxapuvuf.weebly.com/uploads/1/3/2/7/132741714/mutaxulududilef-toxoduxo.pdfIn PDF document text
  • http://subfamjtii.site/pabitasonomaserugugegmtsox.pdfIn PDF document text
  • http://reactivascotia2020.com/45422400159d1lfx.pdfIn PDF document text
  • http://max-lifting.store/sabertooth_990fx_gen3_r2.0_for_salefiq5z.pdfIn PDF document text
  • https://faxefijuw.weebly.com/uploads/1/3/1/8/131872096/vifesadem_pavulidoluvosaw_kevejidal_gedonifegapi.pdfIn PDF document text
  • https://midagadin.weebly.com/uploads/1/3/1/3/131381693/963b16cd6023.pdfIn PDF document text
  • http://alcexpress3.xyz/koxowalepdx8zt.pdfIn PDF document text
  • https://rapokivagifo.weebly.com/uploads/1/3/4/3/134338569/sofoxofuzosaxevafuv.pdfIn PDF document text
  • https://cdn.sqhk.co/dorejewibiz/rjaFcFb/roseveru.pdfIn PDF document text
  • https://cdn.sqhk.co/teketerep/jdchaih/ant_killer_home_depot.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://3c8197b3-f999-4f29-b3da-fbdfea3dbf34.filesusr.com/ugd/0047a4_81df5fc03ae8492abdf237dc93c09b85.pdf?index=trueIn PDF document text
  • https://cbb9655c-b60d-4095-8c1c-bb5f9a2903c5.filesusr.com/ugd/4dd980_ddbc80f263e04bc58e27601857f8b760.pdf?index=trueIn PDF document text
  • https://b46c4cda-4951-41c0-816f-bbf02eee4d9b.filesusr.com/ugd/4ff992_905fc908e99c459bb977c6f698565b70.pdf?index=trueIn PDF document text
  • https://ff999131-262c-4f46-aa1e-84c50d3d9e43.filesusr.com/ugd/a474dd_2d6ed8fc4a394dd29dc18d4d755242ce.pdf?index=trueIn PDF document text
  • https://f9a132f0-acc9-4761-b7d8-38025aedd849.filesusr.com/ugd/5c71d6_8a49e9fbb3df417c92203d201d78583e.pdf?index=trueIn PDF document text
  • https://d427386d-3434-45d9-8802-370857a594f4.filesusr.com/ugd/accd1f_1b29f7296121420aac467baea611fbf9.pdf?index=trueIn PDF document text
  • https://de26864d-dd79-4a6d-8467-b5cf435a6969.filesusr.com/ugd/6ff07c_12a1c192b9e048cba788e46a4febd6eb.pdf?index=trueIn PDF document text
  • https://198d5876-2e36-4a54-a59d-b4c1060b65be.filesusr.com/ugd/4733ca_8555e0b5cb2447c5926bc5da1d439f18.pdf?index=trueIn PDF document text
  • https://deed868a-3c3f-4b0d-b3ae-f9ebe8a38c33.filesusr.com/ugd/95283b_874a82f05172465dba6b5786be69c81b.pdf?index=trueIn PDF document text
  • https://03aaa7dd-6608-466c-a68c-f41c59811c05.filesusr.com/ugd/ae15ca_fb16b08f0a8d47faa11ca79569311eed.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.