Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Urgency / deadline lure low SE_URGENCY_LURE
  Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jumiwimov.ru/strik?utm_term=how+much+does+being+a+foster+parent+pay+in+texas PDF link annotation

  • https://cdn.sqhk.co/jaxugaveg/jKgijd7/rise_up_coffee_roasters_near_me.pdfIn PDF document text
  • https://damatabawapu.weebly.com/uploads/1/3/1/3/131379320/lavejube-nidawubosisime-nijasi-mawojorata.pdfIn PDF document text
  • https://dojunulopifo.weebly.com/uploads/1/3/4/4/134445836/fawelaravotinu.pdfIn PDF document text
  • https://vagapirub.weebly.com/uploads/1/3/4/6/134648019/5845984d.pdfIn PDF document text
  • https://vutavevivusupe.weebly.com/uploads/1/3/0/7/130776898/mogog.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366982/normal_605417b4e81b4.pdfIn PDF document text
  • https://ziwagugo.weebly.com/uploads/1/3/4/1/134131511/5984444.pdfIn PDF document text
  • https://samoderusewon.weebly.com/uploads/1/3/1/3/131383586/5e8c60e5c.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4471240/normal_5fde23e3c2fd8.pdfIn PDF document text
  • https://nagagixibedixu.weebly.com/uploads/1/3/1/6/131606435/f2b0f.pdfIn PDF document text
  • https://cdn.sqhk.co/silijebutu/jfyYgh2/fafifulagar.pdfIn PDF document text
  • https://vewuwoxefi.weebly.com/uploads/1/3/1/3/131379256/1852321.pdfIn PDF document text
  • https://cdn.sqhk.co/noxawuge/bFidjdw/88671882022.pdfIn PDF document text
  • https://cdn.sqhk.co/nizufalagef/gcmJhdp/64511389116.pdfIn PDF document text
  • https://cdn.sqhk.co/bomoxale/9jgrSiM/dawn_of_civilization_an_educational_game_app_download.pdfIn PDF document text
  • https://dulewidojupetor.weebly.com/uploads/1/3/2/6/132695372/dimoduwivapaxif.pdfIn PDF document text
  • https://dozogifelezu.weebly.com/uploads/1/3/4/3/134313369/5022579.pdfIn PDF document text
  • https://dakubotamijez.weebly.com/uploads/1/3/2/7/132712147/6190198.pdfIn PDF document text
  • https://zukutalemuz.weebly.com/uploads/1/3/4/5/134582669/38acdb9ce67.pdfIn PDF document text
  • https://tapugagujug.weebly.com/uploads/1/3/0/8/130813715/6027514.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369507/normal_6051e0d47e919.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://4cf6c2b4-cd84-4b73-83b1-bf7f441162b2.filesusr.com/ugd/e50c99_c67864a669604560b378b773199159fc.pdf?index=trueIn PDF document text
  • https://e18e6c05-101e-4f41-9c4d-f518aea09dbb.filesusr.com/ugd/7972b3_8b12290fc6b94e67a358f34134f76584.pdf?index=trueIn PDF document text
  • https://2bb9e989-9ce9-409f-aa8a-839f2ea8d3bf.filesusr.com/ugd/9f8cc2_e7b91be4a2e2460f9525be2c6f54ef60.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.