Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://gimoguvi.ru/strik?utm_term=me+myself+and+lies+workbook+answers PDF link annotation

  • https://lerasakob.weebly.com/uploads/1/3/2/6/132682990/linibita.pdfIn PDF document text
  • http://lipenav.mypressonline.com/what_instrument_do_we_use_to_measure_weight.pdfIn PDF document text
  • https://vapurexox.weebly.com/uploads/1/3/4/8/134865026/dexoz.pdfIn PDF document text
  • https://supuniwugi.weebly.com/uploads/1/3/5/3/135317388/gepeg_xuroxumi_binuvolej.pdfIn PDF document text
  • https://wezuzasiteva.weebly.com/uploads/1/3/1/3/131397996/7c894eae852b.pdfIn PDF document text
  • https://mogisitubetaw.weebly.com/uploads/1/3/4/4/134496388/taxotozu_jozegovop_luwowakijejovos_xizisomutud.pdfIn PDF document text
  • https://kapiromus.weebly.com/uploads/1/3/5/3/135345701/namet-kavakivig.pdfIn PDF document text
  • https://kumobavubisu.weebly.com/uploads/1/3/0/7/130775432/2428665.pdfIn PDF document text
  • https://webonuru.weebly.com/uploads/1/3/1/4/131437172/4141997.pdfIn PDF document text
  • http://kigumelez.medianewsonline.com/atm_reference_model_in_computer_networks.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/19c45ba0-626f-4001-bf24-83de01886aa6/mizuwunetemobosoboleroxo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f07f1109-7bf1-497f-aaa9-864ad8fba8c6/best_rated_front_load_washer_dryer_combo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b9c98ba2-09cd-4a98-9f5f-2098a0549420/87850866641.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/77ce132f-2b59-40c6-b758-44406bc4000b/26768248472.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/738a1e03-8307-4e58-a9aa-95aa0873aec5/why_does_personal_appearance_is_important_in_the_workplace.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c8bc99f9-6b08-4ee8-baa3-4f23f1a8a70d/chemical_formula_for_corn_oil.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5caa588b-9403-449a-abbb-3986fb47fefb/doctor_zhivago_libro_opinion.pdfIn PDF document text
  • https://f904ef53-caa1-4f0f-8a97-c50675c03ece.filesusr.com/ugd/2f8cea_183044fae53645e680d7f61aaf109ca9.pdf?index=trueIn PDF document text
  • https://68e1e3d4-268d-49bc-a8aa-b119cb10fea7.filesusr.com/ugd/3ceeb9_a98ee75009234405baf80c1062bcabda.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/60ce6131-146a-49c4-8ce9-69e1fb8a1533/how_to_use_hoover_powerdash_pet_cleaner.pdfIn PDF document text
  • https://c301b42c-deab-4116-afcd-a09dd0728425.filesusr.com/ugd/4bb894_4d4f49c1b73c4b9bb6a09a6f6afd97cb.pdf?index=trueIn PDF document text
  • https://adc0bc6f-2b4d-4951-bce0-9128d215fa34.filesusr.com/ugd/5ea4d5_1bf01cf2e15d4f2d94da94aba5baafa8.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/659261f2-32c5-46e4-8e3b-956f0be9fdd0/501_french_verbs_christopher_kendris.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.