Malicious PDF — malware analysis report

Heuristics 4

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dugedepap.ru/strik?utm_term=is+2014+honda+crv+a+good+car PDF link annotation

  • https://static.s123-cdn-static.com/uploads/4489835/normal_6001472578e95.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4420597/normal_6000c0070ace4.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4459055/normal_601cb8cc28e11.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4501770/normal_60044f1585956.pdfIn PDF document text
  • http://puvepum.getenjoyment.net/62172386792.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4463552/normal_5ff1e7b40122c.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/pafexegud/occupational_health_and_safety_management_system_template.pdfIn PDF document text
  • https://s3.amazonaws.com/feliso/71727967499.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1a0af6fb-0161-4d03-9f15-ebd20afd653e/rugexel.pdfIn PDF document text
  • https://s3.amazonaws.com/zetituri/review_of_clinical_anesthesia.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f05aa088-bd42-484d-bbfc-d12281d18179/901780583.pdfIn PDF document text
  • https://s3.amazonaws.com/tiluwisulepam/flowsheet_development_for_copper.pdfIn PDF document text
  • https://9b08d158-0e0f-4203-9b31-e1272d977b1c.filesusr.com/ugd/086daf_1ad601a368e342ddbce304212b65b8cc.pdf?index=trueIn PDF document text
  • https://0e098354-e5d1-4afc-9be7-763a70ae5e44.filesusr.com/ugd/ef253e_272190611f244731a46c804b77dc1994.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/xurixado/can_i_take_my_drivers_test_during_covid_19_california.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ee617558-1004-4073-b4fc-42cf39a03a9c/how_to_attach_the_upholstery_attachment_on_the_hoover_steamvac.pdfIn PDF document text
  • https://s3.amazonaws.com/kuxuxemu/zibadorasisakegipe.pdfIn PDF document text
  • https://s3.amazonaws.com/fizup/pujupunir.pdfIn PDF document text
  • http://kadoxosin.atwebpages.com/gogavunadafemizifa.pdfIn PDF document text
  • https://5090c2af-253d-40c3-bfb7-942fc6db26b0.filesusr.com/ugd/0511f5_95e7c7adc4a3401f89e925e0344726ee.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.