Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jottigo.ru/award?keyword=calendar+2020+singapore+pdf+download PDF link annotation

  • http://majidadap.22web.org/translation_affine_transform_matlab.pdfIn PDF document text
  • http://gtmedis.com/how_to_reset_a1_service_code_honda_civicwqlb6.pdfIn PDF document text
  • https://bomekabekoz.weebly.com/uploads/1/3/4/8/134863976/juduwivavef_pofegijelefi.pdfIn PDF document text
  • https://vekoduxiboba.weebly.com/uploads/1/3/1/3/131398498/lebutar.pdfIn PDF document text
  • http://bewizasosu.sportsontheweb.net/98090296216.pdfIn PDF document text
  • http://spainsale.pro/balitijexigitqm9mt.pdfIn PDF document text
  • http://instup.xyz/screen_time_passcode_won_t_changesm6yf.pdfIn PDF document text
  • https://nulasexojexof.weebly.com/uploads/1/3/4/0/134012614/jujimezusel_lijemiwusa_disamap.pdfIn PDF document text
  • http://neuroncraft.online/odd_eyes_revolution_dragon_rotd9j4sl.pdfIn PDF document text
  • http://melowew.scienceontheweb.net/catholic_encyclopedia_volume_4.pdfIn PDF document text
  • http://mawidoxejonej.iblogger.org/viper_car_starter_instructions.pdfIn PDF document text
  • https://nupejaxisolerez.weebly.com/uploads/1/3/4/3/134348845/dujonatilole_vevudanozukif_nomig.pdfIn PDF document text
  • https://kesoxebexug.weebly.com/uploads/1/3/2/6/132681937/e85b2e101470c5.pdfIn PDF document text
  • http://kataeta.club/what_was_the_worst_day_in_the_stock_marketwfjsc.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://butazajoru.rf.gd/68129837138.pdfIn PDF document text
  • https://c7f0abc7-d23b-482d-bd16-0771495bb668.filesusr.com/ugd/bb13a2_66a3ba8a288c4c119d7507b240f21a80.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/5d5817c4-13b5-4c1f-a7c9-061d2efe3173/what_subject_is_human_geography.pdfIn PDF document text
  • https://709e7e89-b264-4d73-b757-064736ed86f1.filesusr.com/ugd/f523c3_db5f1662ac5649a98b6325205ebe76df.pdf?index=trueIn PDF document text
  • http://konajif.epizy.com/calpers_health_forms.pdfIn PDF document text
  • https://2a4b29e6-a790-453e-81e7-e8b9caf2c27b.filesusr.com/ugd/bf0735_8c9b15e6581f42a8880e3cdfd07dc621.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/842963d3-c5c3-48ea-a4b7-0335395282ac/lavad.pdfIn PDF document text
  • https://db244590-af71-4c33-bd6e-2f8f55f31281.filesusr.com/ugd/fdab61_34df77507cb04136b468fc9d2300df43.pdf?index=trueIn PDF document text
  • https://38aad9b5-7a72-45b8-ac81-9fe73ce82000.filesusr.com/ugd/08338c_5e25137f15bb42729d2c6502f16588c1.pdf?index=trueIn PDF document text
  • http://gezewezelatemak.epizy.com/best_magazine_design_templates.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.