Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://fokemale.ru/wix?keyword=the+mystery+knight+pdf+download PDF link annotation

  • https://rupubonu.weebly.com/uploads/1/3/0/7/130739332/96e93d98b6a74d.pdfIn PDF document text
  • https://kasorewo.weebly.com/uploads/1/3/2/7/132740312/7558748.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/farefasejikap/evenflo_stroller_pivot_xpand.pdfIn PDF document text
  • https://662517ce-f374-4037-aebd-99b1dbe00103.filesusr.com/ugd/0c4177_5baabd548fa6410bb7472868263adfbc.pdf?index=trueIn PDF document text
  • http://worizekadi.epizy.com/bods_interview_questions_and_answers.pdfIn PDF document text
  • https://944bcc21-9f45-42c2-9889-8cf837fa5d1c.filesusr.com/ugd/50f869_011ffcc0fcff4b6c8507c1dd32e396da.pdf?index=trueIn PDF document text
  • https://04934832-22f3-474e-96de-b9d593e92251.filesusr.com/ugd/f390e7_023c215df038441fbcb71f4a3a01ecc6.pdf?index=trueIn PDF document text
  • https://d52aed46-be45-4f9b-8106-cf6fc7ee66c0.filesusr.com/ugd/b148e5_e94daf4d2b6043f29845eb6e876aad24.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/fovezewi/92391249737.pdfIn PDF document text
  • https://86042ffc-9b62-460b-8552-fb2522205a17.filesusr.com/ugd/4f92c1_ca8ae97ad69940888cf7f834b8f75d78.pdf?index=trueIn PDF document text
  • https://df1882fa-13c5-42f1-8438-577935b594b9.filesusr.com/ugd/91932b_340a04d7484d4b92b2481d01a001cb62.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/matogapibelifiv/49529070251.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a238805b-06cb-441b-9ee3-ec93308c80c9/mulelugaduw.pdfIn PDF document text
  • http://zimuwujirosi.rf.gd/vintage_craftsman_bench_top_drill_press.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fd2ad42b-88c3-4cc9-9ae6-c79ef513c530/siwosulanikuzon.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6e98a9d8-0842-4eb9-a7de-8e5ed596997b/programmable_logic_controllers_and_industrial_automation_book_free_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bbc8ea17-2e0d-48b6-a75d-c287385147e0/roland_xp_50_keyboard_price_in_sri_lanka.pdfIn PDF document text
  • https://fab88ded-2f12-46c9-b6ec-f290036286cc.filesusr.com/ugd/cce69c_44f1fc108c274605bd3f46b4fb88e969.pdf?index=trueIn PDF document text
  • https://71e5fc8e-cc9a-4633-96c3-2c70acd464d0.filesusr.com/ugd/f08e01_104a1821c81643e9861c31e669670a6d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/bf0029d5-b1eb-4eb5-9b2a-45ae5a95b384/7452557515.pdfIn PDF document text
  • https://49884795-3b66-401c-adaf-b59e999553af.filesusr.com/ugd/8bd6c9_0034f1ba70764796a321d33099d3ff80.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/xakajoziwibi/sejosativegepuw.pdfIn PDF document text
  • https://s3.amazonaws.com/vanatul/rinidinajubidovapi.pdfIn PDF document text
  • https://4b4b92a8-4ac5-4030-97d5-af0917f8c077.filesusr.com/ugd/0251f0_25908010ce3949ea9291eff7c7541cbd.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.