Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dafemum.ru/strik?utm_term=viva+self+clean+water+cooler+bottom+loading PDF link annotation

  • https://gezonawaja.weebly.com/uploads/1/3/4/6/134685915/bagojiwupuz_fowuno.pdfIn PDF document text
  • https://gupobotinifetex.weebly.com/uploads/1/3/4/3/134338345/6224079.pdfIn PDF document text
  • https://webebusili.weebly.com/uploads/1/3/0/9/130969565/395ae94ee0.pdfIn PDF document text
  • http://ch-redirect.icu/affidavit_form_nswiom3r.pdfIn PDF document text
  • https://sovajavab.weebly.com/uploads/1/3/4/0/134041947/3593286.pdfIn PDF document text
  • http://abzac.me/short_moral_stories_in_english_with_writer_nameo4go9.pdfIn PDF document text
  • http://medway24.com/gelikeruzizarofubukifoddre7.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/f68c2e65-4c33-44c3-8f7a-9688b37adaf1/63806175729.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/afa07d07-44aa-4ac6-a633-c9882586a11f/marshall_dsl40cr_settings.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1557fb33-c6c3-42fe-86ce-5f0286a9f0ef/how_to_hook_up_bluetooth_on_alpine_cda_9884.pdfIn PDF document text
  • https://s3.amazonaws.com/vitelitubovuluj/love_apple_crossword_answer.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/27dda022-323c-4afd-b0d8-bd5a7428d0b2/9_wing_chun_dummy_training_techniques.pdfIn PDF document text
  • https://s3.amazonaws.com/pasawe/24338338764.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5f334beb-a951-4855-9a94-3517c32feb74/74334808676.pdfIn PDF document text
  • https://s3.amazonaws.com/pevuwarobuvowa/google_sheets_remove_word_count.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/70696790-1c99-40de-a288-26b44992ccd2/97742765638.pdfIn PDF document text
  • https://s3.amazonaws.com/jivuxo/subudekoduvekesorujilut.pdfIn PDF document text
  • https://s3.amazonaws.com/babetafaperaxov/sc_dmv_driving_permit_test.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a474249c-5812-4e2d-9035-4b384cf553dc/13299595259.pdfIn PDF document text
  • https://s3.amazonaws.com/sivanira/chogada_tara_ultra_hd_video_song.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d3ccea55-230b-4416-9675-7921c6dbdfda/30787697335.pdfIn PDF document text
  • https://s3.amazonaws.com/sirilagewuga/98830413336.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/aafa4f58-d124-4a12-8d11-0dff3743b360/invisible_fence_brand_transmitter_manual.pdfIn PDF document text
  • https://s3.amazonaws.com/lekelepowo/word_conundrums_with_answers.pdfIn PDF document text
  • https://s3.amazonaws.com/tozaduliwubega/22291234506.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.