Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://resalured.ru/award?keyword=applied+physics+pdf+jntuk PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4422908/normal_60512c63d59dc.pdfIn PDF document text
  • https://cdn.sqhk.co/gulifunanale/idligjd/best_scummvm_games_android.pdfIn PDF document text
  • https://cdn.sqhk.co/pifitudebuxo/gUgjXha/faraway_puzzle_escape_level_8_walkthrough.pdfIn PDF document text
  • https://cdn.sqhk.co/zotofoza/oieoajf/muperibagebovitoza.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4375504/normal_602c1e76b8e96.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4404953/normal_603c62db3bb6f.pdfIn PDF document text
  • https://cdn.sqhk.co/sivojadirabe/lFCTxJe/instagram_pic_er_chrome.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/d172d5ac-a490-420d-8a7b-48b96245327d/manual_de_control_de_calidad_de_auditora_ejemplo_colombia.pdfIn PDF document text
  • https://7fe6b731-3703-45da-bcbe-faf39b4d3392.filesusr.com/ugd/880a7e_984177642d8f41e8b2d8e2ccf595c362.pdf?index=trueIn PDF document text
  • https://7a512b58-7189-4bc4-8343-f643fa9054c9.filesusr.com/ugd/1e52da_1c246df68796451cb6064286f4260c39.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/bogeguva/auto_suggest_box_in_xamarin_forms.pdfIn PDF document text
  • https://d3826037-6016-486c-99e9-dc41bc666644.filesusr.com/ugd/b81754_9968d37073ff40fe83effeb4fd6c4fad.pdf?index=trueIn PDF document text
  • https://f733e552-90a1-4d1f-83ca-a6b36afcf31c.filesusr.com/ugd/38bf1f_47c47480ed494d3fbdcd4377bf3901ed.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/lerezazo/88405465929.pdfIn PDF document text
  • https://s3.amazonaws.com/liluvad/need_for_speed_payback_ps4_trophy_guide.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fdfba3b4-4b73-453c-bb45-99eda3284839/jojab.pdfIn PDF document text
  • https://s3.amazonaws.com/tobaziw/how_to_connect_to_wd_my_cloud_ex2_ultra.pdfIn PDF document text
  • https://101c3d73-5e22-4da1-a203-a3a2a794ce88.filesusr.com/ugd/69a512_ef601355a4ac4f058016884367fe87aa.pdf?index=trueIn PDF document text
  • https://ad9e3d1f-bb22-46ca-892e-b6aa3325a756.filesusr.com/ugd/837d34_10129447d0994f4fba92affdf71edba1.pdf?index=trueIn PDF document text
  • https://dae57379-2785-4108-a223-4562ecbfc22e.filesusr.com/ugd/87ad98_5fee92d8af7645138a6883b49f75a6fc.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/90b012f7-2cb3-4919-8f0e-0506bc14356a/76144211779.pdfIn PDF document text
  • https://033a7475-7ccb-45c1-8f1e-38fd320d48d0.filesusr.com/ugd/03a576_7ee4059d17784086a883665ba603b0a4.pdf?index=trueIn PDF document text
  • https://1482387f-61d8-47e1-b538-9b7f1e8b89fb.filesusr.com/ugd/538d67_26a7a7d298504b6cb103d1339520e96e.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/f3adb029-dbc8-487a-8ed1-8bc97ac0b724/genetics_a_conceptual_approach_6th_edition_solutions_manual_free.pdfIn PDF document text
  • https://s3.amazonaws.com/jivuxo/best_sheet_material_for_winter.pdfIn PDF document text
  • https://f59c0a4d-c104-43ac-8966-a5978cdf1b8c.filesusr.com/ugd/0c1ebd_d4196d281947451985463d0779f953df.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.