Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://nipisod.ru/aws?utm_term=jumperoo+age+and+weight PDF link annotation

  • https://cdn.sqhk.co/tegiriwepaj/fLico9E/flights_to_miami_from_nyc_cheap.pdfIn PDF document text
  • https://cdn.sqhk.co/rigizisojix/oicigid/marorujaduj.pdfIn PDF document text
  • http://tells.fun/82725099574bj3b3.pdfIn PDF document text
  • https://cdn.sqhk.co/biluvetizom/ghehehc/83126907357.pdfIn PDF document text
  • https://sesuwulot.weebly.com/uploads/1/3/1/4/131438847/xidadexazipaxepoxu.pdfIn PDF document text
  • https://cdn.sqhk.co/mogowepuw/jgTiege/voxuzusixavudumedevezu.pdfIn PDF document text
  • https://cdn.sqhk.co/vogigoda/jaZjca4/bemodevurudemup.pdfIn PDF document text
  • http://construt.site/pencil_art_drawing_easy_girlv5xsg.pdfIn PDF document text
  • https://xasigorokukexef.weebly.com/uploads/1/3/4/8/134891024/3c7e590a5c6.pdfIn PDF document text
  • http://xtreme-sport.ru/crochet_patterns_for_easy_hats7qi92.pdfIn PDF document text
  • http://1xbet-sportstavki.fun/4048408210bmln7.pdfIn PDF document text
  • https://lupoxever.weebly.com/uploads/1/3/1/4/131413766/f618817bbfa836a.pdfIn PDF document text
  • https://duxuxapuxud.weebly.com/uploads/1/3/5/3/135332588/sodetene.pdfIn PDF document text
  • https://lalusaguru.weebly.com/uploads/1/3/4/6/134611329/dofamebeba.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/xubifupi/adhesive_foam_tape_sheets.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/77622e8e-6403-4cfe-948c-93020b36c98d/how_much_does_it_cost_to_get_a_new_exhaust_system.pdfIn PDF document text
  • https://56148a0a-83a3-4003-94ff-78d3044b7c00.filesusr.com/ugd/6f5f23_4e0a46fe03d347f0a9897a3075ee2a18.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/15d754e6-73f2-4d53-852d-3b6c36cb62c7/bebifuxaxewijolaku.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/04eb95aa-165b-41a9-be4c-258b0953584f/nordictrack_c2200_belt.pdfIn PDF document text
  • https://beea745c-e446-4317-9ad8-fe501d584c0a.filesusr.com/ugd/9196db_a78853c7dff44572abda103db0a1048e.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/cf8db729-1f4f-47c0-b45e-e172e1112290/what_are_the_only_two_rivers_that_flow_north.pdfIn PDF document text
  • https://s3.amazonaws.com/penefelomiju/nibelibupow.pdfIn PDF document text
  • https://s3.amazonaws.com/jutenojamega/pojiwipupamu.pdfIn PDF document text
  • https://s3.amazonaws.com/lulelepese/what_is_the_structure_of_book_report_sample_paper_brainly.pdfIn PDF document text
  • https://s3.amazonaws.com/tobovunoberiki/toganudaguvaku.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/625c3028-2a6e-41a4-bf6d-4ef58e0c992b/jejorufulatidezibaziv.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.