Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://xajibur.ru/wix?keyword=moedas+americanas+como+identificar PDF link annotation

  • https://cdn.sqhk.co/xolilipedeko/cUgegjW/bandpass_speaker_box.pdfIn PDF document text
  • http://milatepe.medianewsonline.com/differential_calculus_application_problems_with_solutions.pdfIn PDF document text
  • https://cdn.sqhk.co/pevelefotuve/ghylTje/55009926024.pdfIn PDF document text
  • http://presalle.xyz/spotify_premium_free_songs_iosfgx3d.pdfIn PDF document text
  • http://ionatr.fun/zumajoxexutawodaghze2.pdfIn PDF document text
  • https://cdn.sqhk.co/rojisixel/ibhesdS/ben_newsam_co_uk.pdfIn PDF document text
  • http://redpandarecycling.com/how_to_use_an_innova_3020mep56.pdfIn PDF document text
  • https://cdn.sqhk.co/jawutuwek/WW0K8gi/coin_counter_bank.pdfIn PDF document text
  • http://ita-yog.space/48793967095f6kxj.pdfIn PDF document text
  • https://cdn.sqhk.co/xuvomuvugu/argjpld/jenaxevezujimoxozadusoxaf.pdfIn PDF document text
  • https://cdn.sqhk.co/golemejexeno/0Qr74jd/kokivumexivu.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://2a082fd4-e93f-4b8e-9e59-408fa046b31c.filesusr.com/ugd/e334dd_636443a9e3e6447d9ba183c17e3cde8e.pdf?index=trueIn PDF document text
  • http://rojanesifilagu.myartsonline.com/code_name_verity_summary_part_1.pdfIn PDF document text
  • https://74bb8966-1fc2-43cb-a641-24c20f380d28.filesusr.com/ugd/84c7b5_3606dc6ce43e4f44aaac58611ca86399.pdf?index=trueIn PDF document text
  • http://livirava.atwebpages.com/is_a_2012_hyundai_sonata_hybrid_a_good_car.pdfIn PDF document text
  • http://vilumepidiwego.myartsonline.com/lerikugawuka.pdfIn PDF document text
  • https://650c977b-0274-48a2-8498-43c0efc39f4e.filesusr.com/ugd/dbad32_6d88654d5ff4420390ec5c59178a9c6e.pdf?index=trueIn PDF document text
  • https://1e16f6d7-285b-4488-bf07-d3e24ac90e20.filesusr.com/ugd/417718_198c48bde93f4446bb20a2485a2dd020.pdf?index=trueIn PDF document text
  • https://0ca12155-7937-4926-a9d0-23a43aecd1f4.filesusr.com/ugd/d55797_efd678e58cfe4578a99cff1f30a4d473.pdf?index=trueIn PDF document text
  • https://171e2b11-24ea-4535-acac-f971ec821c4b.filesusr.com/ugd/a07927_6d5f790045f240ef9a5bb0eab5ff996d.pdf?index=trueIn PDF document text
  • https://1c8fadd7-09eb-4d2b-9d42-8e747ba5ce52.filesusr.com/ugd/60625b_efc9e2644dcf429281994425ba5d702c.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.