Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://leonvi.ru/wix?keyword=holt+science+spectrum+physical+science+math+skills+answers PDF link annotation

  • https://mokoxobijukox.weebly.com/uploads/1/3/4/3/134321678/kilamojixomakin-zatawaxuta-puzejofetebuxog-nunibas.pdfIn PDF document text
  • https://fomujozi.weebly.com/uploads/1/3/4/0/134016754/modezubu.pdfIn PDF document text
  • https://parafobosa.weebly.com/uploads/1/3/1/8/131857791/jemipifimumixodumuki.pdfIn PDF document text
  • https://wezozutu.weebly.com/uploads/1/3/4/6/134653249/bexubivonuxadoludoti.pdfIn PDF document text
  • https://beperupofifu.weebly.com/uploads/1/3/1/6/131636755/9545974.pdfIn PDF document text
  • https://puwuvesudalifos.weebly.com/uploads/1/3/0/7/130738622/28a9d6d83.pdfIn PDF document text
  • https://sefoxobifi.weebly.com/uploads/1/3/6/0/136093232/gikelo.pdfIn PDF document text
  • https://sozizupisez.weebly.com/uploads/1/3/1/8/131872239/fozixofemoxinuminu.pdfIn PDF document text
  • https://fodubimofo.weebly.com/uploads/1/3/4/8/134884763/f367c843096d.pdfIn PDF document text
  • https://dudepemak.weebly.com/uploads/1/3/4/7/134702006/9139714.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/3af4be5d-d533-40a2-bc1a-a19a8735da22/what_is_romantic_love_literature.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c6faea85-f14a-45ae-9ea0-f48269958d4c/puvinoji.pdfIn PDF document text
  • https://s3.amazonaws.com/zodawanuror/android_transparent_actionbar_in_fragment.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/95980129-e8b5-47c3-87bc-33d73ab7c367/mizokigiwowapibi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/986abbaf-3f95-4d1e-a72c-6986e71ee5b0/40375631910.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/65b6a584-d8a7-407a-b760-aedea8ea98d8/jegunepunuxufo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/123ad1ca-d557-462c-9807-0c45d6c5b11e/five_nights_at_freddys_survival_logbook.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/735b4ce8-7b74-4433-a578-31a86c3fd990/scott_pilgrim_vs_the_world_comic_characters.pdfIn PDF document text
  • https://s3.amazonaws.com/polexebuj/78736086347.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/16179c70-fbf4-4f8f-a5e6-37c25720ee95/trimble_business_center_5.2_requirements.pdfIn PDF document text
  • https://s3.amazonaws.com/tumasun/printable_isometric_sheet.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b1532592-c176-4fd3-93ab-0f1def73adec/27489550075.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/be8e5eed-c3ba-45e2-b548-d11588bfbb68/vibupaxufiwuro.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1e8508e9-11cf-434a-88f9-05235447d947/gaturixibifemonenowupubi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/efd2ff3b-1847-4b41-b165-9cfa3d0cd226/ion_pro200bt_bluetooth_wireless_turntable_review.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.