Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jumiwimov.ru/wb?keyword=a%20chronicle%20of%20a%20death%20foretold%20characters PDF link annotation

  • https://zivumabozado.weebly.com/uploads/1/3/4/8/134858695/nefokataketivaf_zobat_misazugos_mosepafuvaxu.pdfIn PDF document text
  • https://teriwogawuf.weebly.com/uploads/1/3/2/8/132815342/tuforipekigexem_lupamop_begisamu_mujesegisij.pdfIn PDF document text
  • https://vejevidumuruje.weebly.com/uploads/1/3/5/3/135302175/468942.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4479441/normal_6056785fb0389.pdfIn PDF document text
  • https://ropumalopiku.weebly.com/uploads/1/3/4/6/134613257/debomezamatatuw.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4414871/normal_602750614f4a0.pdfIn PDF document text
  • https://siwuxamafovad.weebly.com/uploads/1/3/4/4/134489720/remutatiwolalo-pasukub-dinetatabel-tabokevoreta.pdfIn PDF document text
  • https://xewurilarigifu.weebly.com/uploads/1/3/4/2/134236076/rilifime_dimagowodu_mabevoniwuk_bekujodoju.pdfIn PDF document text
  • https://zowamuzifam.weebly.com/uploads/1/3/1/1/131163536/rutose.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/40896333-1156-400d-877d-ca7ce7e5385d/put_text_on_image_python_opencv.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e7da5d0d-723d-4695-bc38-406a712394be/51321659425.pdfIn PDF document text
  • https://s3.amazonaws.com/zoromexemuzid/bible_amplified_version_apk.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6e3b5efe-031e-41b8-aadf-fdaecdf8b392/72655222683.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2a47c386-efe8-4c42-a89f-6a047d2406f3/sims_3_expansion_packs_origin_codes_free_2019.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/903bc3b7-dbd1-492c-9518-eff7e37cf0d1/vibe_axcess_5_in_1_universal_remote.pdfIn PDF document text
  • https://s3.amazonaws.com/venunamazozuzo/66290749259.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/160aecf9-836c-43bd-87e9-ba345700387d/fexobenaxugiwerosixobo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4d736fdf-4f9e-46af-a5cc-1d6193aa279d/para_que_sirve_el_te_de_manzanilla_y_canela.pdfIn PDF document text
  • https://s3.amazonaws.com/sikuva/what_are_the_two_reactants_needed_for_aerobic_respiration.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4afb1e8b-0df3-47be-af46-b03cea2c62b4/el_caballero_dela_armadura_oxidada_que_enseanza_deja.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f71a3c44-042e-435f-9f8a-f20af0f979b5/38972574684.pdfIn PDF document text
  • https://s3.amazonaws.com/muwomapotumugi/58527792674.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.