Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://oniceh.ru/pbw?utm_term=assassin%2527s+creed+identity+size PDF link annotation

  • https://gobazivow.weebly.com/uploads/1/3/1/0/131070387/5ab09f5ca.pdfIn PDF document text
  • https://rofaxebawo.weebly.com/uploads/1/3/4/7/134750080/8634c.pdfIn PDF document text
  • https://xizotikozuza.weebly.com/uploads/1/3/4/5/134587863/tirezizipofi-borefa-venekovika.pdfIn PDF document text
  • https://bonifivudinuf.weebly.com/uploads/1/3/4/3/134305406/2c8e9cf219f.pdfIn PDF document text
  • https://nekazadezi.weebly.com/uploads/1/3/4/6/134662300/pepokidotad-neliturapoxifu-kolibeke-tadobil.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/abf871f8-4338-49b8-a5fc-955e8e65348c/83898168503.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/33a85e2c-494d-43cb-9eff-2903518b8650/piloguxezobizuwuroxavetop.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1fe5108e-8be6-4684-8587-99030bc5328f/computer_systems_engineering_uga.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/aba9ee80-6e51-4727-ab54-c530aa11af62/71679668634.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/abc2d709-00d7-4c07-9ff4-aa87b7672f78/83890521964.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7a44a141-c96e-4df6-85cb-c592c8da93b5/98357695496.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5e7d7a21-3676-4073-944e-066409c99b09/casa_essentials_pressure_cooker_manual.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f57d0f09-0069-4a22-82e7-8cfed0771040/what_does_an_early_dinner_meaning_in_tamil.pdfIn PDF document text
  • http://mogulobobis.pbworks.com/f/candyfloss_jacqueline_wilson.pdfIn PDF document text
  • http://sagidetubi.pbworks.com/f/12226497944.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8e23cf05-c68b-4cf2-9969-fb877cf1c794/35732560761.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1857e869-74b0-43bd-acc5-6793ba91b414/57618232487.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3f638d8b-d9d4-42af-af58-95b28d14e56e/16080548417.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/276adb49-d44d-4482-9b3b-4753d7628174/puronitokipanewim.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/14799fc8-d0af-4586-aa4c-d4b18417bdac/29674175046.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/debc0ba9-e4eb-4b21-a2f5-4ef68fc75612/82920014123.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/24d547a7-0b8f-4e85-8b6c-b198bfc3b723/what_is_the_iris_diaphragm_lever_on_a_microscope.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f948334a-f6a9-4778-83aa-a798ad900eb5/74557265806.pdfIn PDF document text
  • http://fogofalo.pbworks.com/w/file/fetch/144547263/how_to_apply_letter_of_undertaking_in_gst.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.