Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jottigo.ru/strik?utm_term=why+is+my+coffee+grinder+not+working PDF link annotation

  • http://rofogukiluvupu.mygamesonline.org/research_approach_and_methodology.pdfIn PDF document text
  • https://takesefitetipal.weebly.com/uploads/1/3/2/6/132682925/mubal.pdfIn PDF document text
  • https://zediruli.weebly.com/uploads/1/3/4/7/134725524/c19dc6b.pdfIn PDF document text
  • https://cdn.sqhk.co/zaviresodew/aTWifhb/tibirumutugatatetemibomik.pdfIn PDF document text
  • https://cdn.sqhk.co/kubasovusi/iicLide/16296448285.pdfIn PDF document text
  • https://lefiletigej.weebly.com/uploads/1/3/4/5/134597596/2620032.pdfIn PDF document text
  • http://purubifo.medianewsonline.com/52567224856.pdfIn PDF document text
  • https://cdn.sqhk.co/sepovili/ehdBqmk/radio_italia_live_milano.pdfIn PDF document text
  • http://koxelovanalimu.getenjoyment.net/madevajabolijek.pdfIn PDF document text
  • https://cdn.sqhk.co/gonolesuzam/gcihAhg/23418444019.pdfIn PDF document text
  • https://soxoxalumowaju.weebly.com/uploads/1/3/4/7/134768556/fepaxegijolometazo.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://aa6d2f86-95e2-42cc-897e-6bbd71c3a116.filesusr.com/ugd/78daac_f73cfda62b984c4c9cb4ed6c7f8aac65.pdf?index=trueIn PDF document text
  • https://c6f55193-7475-4343-97dd-33cb3b141b6a.filesusr.com/ugd/808d8c_8c44cf5e65754faf83cf6593c0394690.pdf?index=trueIn PDF document text
  • https://48e6b720-b653-4920-beb0-7ef171ab6ab9.filesusr.com/ugd/d9d1f5_28ed589d46a144478dcdc20c432d0a0b.pdf?index=trueIn PDF document text
  • https://e668d0bc-6b9c-4787-ac64-5363b724ef62.filesusr.com/ugd/6ec699_d169a0c905b64f37868bebd7c1efe4c6.pdf?index=trueIn PDF document text
  • https://2a0daf8d-7d8f-48a8-9da6-1f2c606fcb3a.filesusr.com/ugd/adb9e1_97b3105f0d3643c4a587540b8b727f4c.pdf?index=trueIn PDF document text
  • http://rinexevijexaxi.epizy.com/diduvukekoke.pdfIn PDF document text
  • https://ae0ecf71-49bb-4ac4-bba4-d0f2a20d1af9.filesusr.com/ugd/668a47_2fab98ad1d3f495bb67c6c15f8be97ff.pdf?index=trueIn PDF document text
  • http://wororezijetixa.atwebpages.com/learn_german_while_you_sleep.pdfIn PDF document text
  • https://c2dbac7f-2075-4dc1-ad03-af0d0352bff2.filesusr.com/ugd/278743_a2ed87a4a76b43ae93780026c692d468.pdf?index=trueIn PDF document text
  • http://buzanone.epizy.com/school_counselor_interview_questions.pdfIn PDF document text
  • https://9cc02d22-446e-415d-9686-6e49aadcb3b3.filesusr.com/ugd/aa6a08_876760e6d23a4cc59024c1b07d0ab149.pdf?index=trueIn PDF document text
  • https://1fd079ea-3156-4ae8-a0b4-6153e0b529c5.filesusr.com/ugd/e66bf7_1ff504695e1e47b2bda1722816313c59.pdf?index=trueIn PDF document text
  • http://bajefeluxit.rf.gd/ariston_washing_machine_aml_125_manual.pdfIn PDF document text
  • http://jujewejono.epizy.com/22241524648.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.