Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://fafetomipisiso.weebly.com/uploads/1/3/4/6/134603542/bac14904f196.pdf In PDF document text

  • https://s3.amazonaws.com/kasuwevovog/handicapped_parking_application_form.pdfIn PDF document text
  • https://dodikajopofibu.weebly.com/uploads/1/3/4/7/134704264/df25efef8d222.pdfIn PDF document text
  • https://titoboxe.weebly.com/uploads/1/3/0/8/130874676/paxam_wazopo_zibewebug_tekaribulu.pdfIn PDF document text
  • https://s3.amazonaws.com/rowubunak/laundry_detergent_for_bamboo_sheets.pdfIn PDF document text
  • https://s3.amazonaws.com/xelimewat/peruvugiwurosogipemenak.pdfIn PDF document text
  • http://firejifanop.iblogger.org/how_do_i_change_the_lightbulb_in_my_kitchenaid_microwave.pdfIn PDF document text
  • https://s3.amazonaws.com/leteraxewe/wind_waker_dragon_roost_island_guide.pdfIn PDF document text
  • http://taxavifixe.22web.org/is_global_developmental_delay_a_learning_disability.pdfIn PDF document text
  • https://bologen.ru/strik?utm_term=dr+terry+wahls+protocol+bookPDF link annotation
  • http://www.ascendercorp.com/In extracted file (font_00_sfnt_off0000feb3.bin)
  • http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off0000feb3.bin)
  • https://uploads.strikinglycdn.com/files/f5560440-cde4-4d34-a118-675386db71ca/22648788078.pdfIn PDF document text
  • https://7fca5364-97a1-4441-b76e-d2c429a59218.filesusr.com/ugd/735424_8096a677f497461d8f704f6ad8278359.pdf?index=trueIn PDF document text
  • https://217ba8a6-026c-4a9e-b1ce-2eadff0a4a08.filesusr.com/ugd/3d7af5_9d5321bcce34482cb2646909b7ca7952.pdf?index=trueIn PDF document text
  • http://lonivone.rf.gd/iso_business_income_and_extra_expense_form.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0e5c70cf-a971-403f-83d8-5852f53358c9/how_do_i_contact_better_business_bureau.pdfIn PDF document text
  • https://5366dd3f-28a3-4342-b8e5-5bed86455aec.filesusr.com/ugd/a92322_b7115113a0a940d1bc7f073f27001022.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/363d23f2-996d-4561-bbe6-76745330880c/what_is_the_ending_of_the_heirs.pdfIn PDF document text
  • https://95043331-d9de-4498-ad98-35b8ac3ee23f.filesusr.com/ugd/5740b2_ab293028167e4944ae80363d45d32a96.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/1e90eb20-0728-475f-a574-e6f57d32fdd0/zotogaxotojosaliruraf.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/31565001-4e80-4423-8e12-f666f69e35fd/learning_spark_2nd_edition_download.pdfIn PDF document text
  • http://dileginaduke.epizy.com/childrens_books_with_lessons_for_adults.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/acf07ad7-8d79-4204-9b47-c0cedc91f87d/kejiwakuwafefenujiten.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1a1f281a-1fb5-4372-9415-af5b267193b6/franz_kafka_the_trial_summary.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off0000feb3.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.