Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://crophysi.ru/123?utm_term=cheppave+chirugali+movie+songs++free In PDF document text

  • http://13millions-warzone.store/mubezesefejubamwmnk.pdfIn PDF document text
  • http://fsfsfd.xyz/monster_defense_tower_defense_games_free_download2aijc.pdfIn PDF document text
  • http://antileqphh.site/zidagakexesisakigazil78a3c.pdfIn PDF document text
  • http://verification-help.business/vive_vr_space_requirementsijs3j.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://6c892e0d-5736-4b4a-96a3-cd490fd1fe3d.filesusr.com/ugd/1407cd_189a96322968423bbb384cd9b7c257dd.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/9f5a6a8e-2cce-4cd7-ac33-8a829dcdf132/69025593037.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d212334a-4b58-4f60-88b9-b205e59588b7/how_to_read_vishnu_sahasranamam.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c7a65d15-178c-434f-ad6a-2772baf44516/restful_web_services_example_in_java_using_spring_boot.pdfIn PDF document text
  • https://d62ff7d9-aefc-4ab8-8cdf-af38868aea16.filesusr.com/ugd/54b9a1_a9513b8f9b784f8b95e063ef1b79210e.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/fowikorejodi/savijisebenibibakagutujid.pdfIn PDF document text
  • https://s3.amazonaws.com/zazelujeju/vofetesevinugefa.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bfde275a-10aa-4ba2-b4c6-304387728aa5/contoh_surat_lamaran_pekerjaan_format.pdfIn PDF document text
  • https://b2f3f1fb-4f3f-4d5d-be65-f5b10dce6288.filesusr.com/ugd/735189_6b6dbd70bdda4d95a0c6188746efba5b.pdf?index=trueIn PDF document text
  • https://a4edf7fa-b057-49b5-8014-e5fd436fbef3.filesusr.com/ugd/c8b2c5_b20f9d9553bf482da90693063acfa70c.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/kopisigapub/92362702335.pdfIn PDF document text
  • https://123949be-7110-4ba3-a240-a7df06fb38ce.filesusr.com/ugd/80fd5d_3212c2e66562497ebbbbe2ffe0c63f9f.pdf?index=trueIn PDF document text
  • https://d0fd22f1-78bd-4368-960d-2a324028b2bb.filesusr.com/ugd/a4d998_949e9a3551574c1795f8c93b52e3c188.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/7452cdbd-79fc-4157-a21b-3a5c56d73ce0/6_steps_of_conflict_resolution_high_scope.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/95b34f4d-bd94-4ab5-adb0-8bb6d84351d6/xofivapidofog.pdfIn PDF document text
  • https://s3.amazonaws.com/gaxuremewuger/97591281652.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fea4e0c6-efac-4a14-8838-cb2c030e7ed9/29542406406.pdfIn PDF document text
  • https://e72deea9-3c4d-48de-8429-d2e8e2d5d9b3.filesusr.com/ugd/68b2df_2bf1bd0c747d4e00affc59ba96598cbf.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.