Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
  Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://lozipotod.ru/award?keyword=caedmon+s+hymn+pdf PDF link annotation

  • http://mofobawosenej.mygamesonline.org/mosexupekiledegujiziwi.pdfIn PDF document text
  • http://powajaxib.medianewsonline.com/vibuzelulubibado.pdfIn PDF document text
  • http://gonifarej.mywebcommunity.org/auditing_standards_list.pdfIn PDF document text
  • http://figuxovutofid.mygamesonline.org/cuestionario_de_los_cinco_lenguajes_del_amor.pdfIn PDF document text
  • http://bumisemi.iblogger.org/bonhomme_allumette_jacques_martel.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/62168bc0-208d-4845-8096-9d3eab399efe/how_to_increase_calories_on_keto_diet.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9a1a7b9e-9d0b-4798-a929-1936920b7998/subway_tuna_salad_nutritional_information.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/29ab7147-ddea-4904-b7eb-ba0531835137/what_ink_does_epson_wf_3640_use.pdfIn PDF document text
  • http://womififirijafe.rf.gd/collect_all_shells_links_awakening.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d04e0da3-7ae6-477a-895a-576fabc89682/xatolasawexibevur.pdfIn PDF document text
  • http://nakepusigazu.epizy.com/67964225809.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e60071f8-cceb-4b78-b66f-5dc387239126/resumen_del_capitulo_4_de_batallas_en_el_desierto.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cf136a22-c059-41fd-8421-07da6f69c588/stata_13_tutorial.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/99dff3ac-6e96-44b4-9e1a-7e9df42243ce/sharp_roku_tv_flashing_power_light.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/59dc880e-b1c2-4ad3-b906-5a1a6814d226/78553239079.pdfIn PDF document text
  • http://limepupotof.epizy.com/letter_writing_format_for_sick_leave.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f8769d72-5a91-473c-87cc-f02384e538c0/96497247044.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7feb894c-5faf-4a4b-8cd7-1da42604932a/how_to_make_an_app_on_code.org.pdfIn PDF document text
  • http://sebokegekesuded.atwebpages.com/2000_ford_ranger_mpg_v6.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ac1b6bfd-d8d8-470d-a4d5-2bf495e2785c/25165686061.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/366326ef-513e-410b-8ca9-e1da046798b2/how_to_make_money_as_an_educator.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8333c7e6-d90b-4a1b-9a1e-501964a64e60/can_you_replace_a_magnetron_in_a_microwave.pdfIn PDF document text
  • http://jalijoruki.atwebpages.com/english_to_spanish_dictionary.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d64a4d79-9f30-44db-a36b-ed49496d0b6d/how_to_activate_tableau_license.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3e9070e5-2ce6-4d30-9199-e90ec5b66588/python_for_beginners_tutorial_youtube.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.