Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://pelibifir.ru/strik?utm_term=how+to+explain+simple+compound+and+complex+sentences PDF link annotation

  • https://static.s123-cdn-static.com/uploads/4482638/normal_5fffba8d91771.pdfIn PDF document text
  • https://sisufowikukutu.weebly.com/uploads/1/3/4/3/134311685/42090c26567335a.pdfIn PDF document text
  • https://vulajavup.weebly.com/uploads/1/3/4/6/134683256/padulas-kuborupejira-jelibubemudetej-ruped.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4374839/normal_601976ec0858b.pdfIn PDF document text
  • https://xaviloxoganobe.weebly.com/uploads/1/3/1/3/131383750/vosofidovipuno.pdfIn PDF document text
  • https://jutewalezozapon.weebly.com/uploads/1/3/4/0/134016751/mowikesi.pdfIn PDF document text
  • https://fivakamine.weebly.com/uploads/1/3/4/3/134384559/4431782.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/ed4e4bb0-d438-46b7-9cbf-e2d5d8dff2e6/printable_bible_trivia_questions_for_youth.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ba6776fa-28cc-4d4f-9cac-86aacad8de1e/a_christmas_carol_2020_bbc.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c2142360-d8fe-4a5a-a2cf-b49c21190f2b/xunigovaxetogo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9e1cd4c9-87ba-4610-a586-cbc92d4e2bfe/is_max_movie_on_netflix.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e6e71f1f-fe4b-4f6f-af88-a935cfdff3f2/wajajelapijafedoxinaxil.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7e71d71a-44d6-4177-b998-0804dccd26ad/farupogufisug.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/28196e63-9eb0-4889-ba6d-db81a6adc8b1/14478073694.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ff91fa45-9fee-402f-9ec4-06809c072ae9/whirlpool_quiet_partner_iii_heating_element.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2427d6f5-6c5d-405f-ab94-74ed7a518fd2/facebook_account_recovery_code_phishing.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7dd3ecd9-9e2c-426f-a19b-0a1afbfced94/the_martian_hindi_download_filmyzilla.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e9913fc5-bebc-44da-94c5-358eb2e7f139/21334292669.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/55405ec2-49f6-48eb-aeab-ec529f41f91b/how_to_stop_a_married_man_from_pursuing_you.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fb693938-001d-4d26-9f9b-669ebd714587/initial_consonant_sounds_worksheets_for_kindergarten.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/81b19896-01c9-45bc-9e23-4965f708ccdf/which_element_has_two_valence_electrons_and_three_energy_levels.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c5d5dda5-c1e0-4daa-9e20-53b7196211d5/21482700439.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b933d2fc-c282-4ac8-bb99-c7a6b7695861/61526690768.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b0829bb6-94b4-445d-98af-6e3b0bfbca36/how_to_save_webpage_as_on_macbook.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.