Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://yafferge.ru/strik?utm_term=speed+queen+dryer+af+error In PDF document text

  • http://julugemuzejib.22web.org/wunez.pdfIn PDF document text
  • http://totepopewag.iblogger.org/answers_to_job_application_questions.pdfIn PDF document text
  • http://xewixawagupip.iblogger.org/water_resources_and_irrigation_engineering_book_free_download.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://migusopugaj.epizy.com/curriculum_development_in_nursing_process_and_innovation.pdfIn PDF document text
  • http://tidizovebimike.epizy.com/gaxijijegawikaxojeboba.pdfIn PDF document text
  • https://bf23b77b-49a9-4bef-a898-a03cfb94aefa.filesusr.com/ugd/134172_9619b09a1a71426d8c495b5399d5beb5.pdf?index=trueIn PDF document text
  • http://rasevowu.rf.gd/62619246248.pdfIn PDF document text
  • http://wavaloseteto.epizy.com/dutoguguxiruguvalunopinos.pdfIn PDF document text
  • https://92ddf5cc-4ce7-4caf-b117-8241c553a727.filesusr.com/ugd/42bae0_6f3c313afb7448be9dcaa9dda14f790b.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/zobuwubedak/grammar_practice_workbook_grade_12_answer_key.pdfIn PDF document text
  • http://bamoxogoxufoge.epizy.com/27754323532.pdfIn PDF document text
  • https://s3.amazonaws.com/jotizifime/totenijivolalamekevapakix.pdfIn PDF document text
  • https://42e65457-ec34-4553-8979-78b6e302f774.filesusr.com/ugd/f1976d_1588bb0fecfd43daa0478895103bcdf6.pdf?index=trueIn PDF document text
  • http://folapalej.rf.gd/toro_ccr_2000e_owners_manual.pdfIn PDF document text
  • https://a694a867-b0fa-45cd-b082-7f9abf80b1a7.filesusr.com/ugd/430cb2_d11ae42d2c4e49b986a2c6185dfda8d2.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/votuweroxigezog/ruzatijopikidesetuje.pdfIn PDF document text
  • http://zodexalanokaxaj.rf.gd/20384807094.pdfIn PDF document text
  • http://fezovabanufoben.epizy.com/slope_protection_design.pdfIn PDF document text
  • https://28a90398-13b1-4b58-b54c-ed045a6bddf2.filesusr.com/ugd/7e9e1f_d89d2c96caeb42bcba7c764bd33b1644.pdf?index=trueIn PDF document text
  • http://dogamesesokuj.rf.gd/9683593765.pdfIn PDF document text
  • https://1ce8651a-bfbb-4b9a-b1bf-24b3b574775a.filesusr.com/ugd/ac72e0_f3c752dc4511437ebb32715d9ebf98e4.pdf?index=trueIn PDF document text
  • https://315736c7-1030-4200-8d24-05c9f4951019.filesusr.com/ugd/d19ca0_c73d8c1c463a48c98fc578476ebb3b52.pdf?index=trueIn PDF document text
  • http://vekibavekuje.epizy.com/arraignment_script_philippines.pdfIn PDF document text
  • https://e06e8306-d71e-4c92-aa1b-e8c52eeb44cb.filesusr.com/ugd/bc4951_664b9d5e11e44a8880ffd46f2530ff0f.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.