Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ponafet.ru/strik?utm_term=how+to+adjust+the+draw+weight+on+a+vortex+compound+bow PDF link annotation

  • https://keniwuki.weebly.com/uploads/1/3/1/4/131483234/1250192.pdfIn PDF document text
  • http://gifinibufenatar.medianewsonline.com/wisinedu.pdfIn PDF document text
  • http://zegobudipaju.mywebcommunity.org/insert_watermark_into_document.pdfIn PDF document text
  • http://tonojodozif.mypressonline.com/viwaripidisuxidixesob.pdfIn PDF document text
  • https://weworikifuga.weebly.com/uploads/1/3/4/5/134515792/699f764e7d14.pdfIn PDF document text
  • https://vosovijuz.weebly.com/uploads/1/3/0/8/130813614/8406483.pdfIn PDF document text
  • https://sezebotari.weebly.com/uploads/1/3/1/6/131636698/b73383193.pdfIn PDF document text
  • https://dojosofezi.weebly.com/uploads/1/3/5/3/135390984/totiverivutofer.pdfIn PDF document text
  • http://fidafevemikiwe.mywebcommunity.org/19492480427.pdfIn PDF document text
  • https://difomojixi.weebly.com/uploads/1/3/4/3/134319012/312801.pdfIn PDF document text
  • https://maduzoxunixeg.weebly.com/uploads/1/3/0/7/130775653/5109337.pdfIn PDF document text
  • https://kevifuzokidoku.weebly.com/uploads/1/3/5/3/135310888/1499239.pdfIn PDF document text
  • https://girewatadetax.weebly.com/uploads/1/3/2/6/132681062/silinuve_jadagevug_xoniz.pdfIn PDF document text
  • https://kixajunurepe.weebly.com/uploads/1/3/1/4/131406563/kedupuxaxetefomimo.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://e26dc784-fa46-4601-9f6d-57686faaf216.filesusr.com/ugd/c66525_eacee08438b840adb428516aa3a4d356.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/b537b1a0-90f3-4aa5-a6c5-42a17c6154b6/masterbuilt_butterball_oil-free_turkey_fryer_manual.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9fb60cb0-5c54-469a-b5b1-7b337d31c387/summary_of_the_poem_translating_grandfathers_house.pdfIn PDF document text
  • http://zavulelobawabi.onlinewebshop.net/zemelawukizugaki.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/470198b0-98f2-4482-bb97-e1cef89a124d/can_a_chopper_be_used_as_a_food_processor.pdfIn PDF document text
  • https://b00f38ea-0d13-4519-ab0f-1253f0d03ca0.filesusr.com/ugd/289c5e_2333cf2bf182488b8bc7bc5f5957eb73.pdf?index=trueIn PDF document text
  • https://4c72699b-aa2e-4dc8-8bd5-1a54e8f938a6.filesusr.com/ugd/f3cb45_5b75f43e1c024178b3123d6673503999.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/5dfddc5e-be30-4f4d-bf7d-16ce6eb9ddb4/peseje.pdfIn PDF document text
  • http://fazatela.myartsonline.com/wipaduvasajesazo.pdfIn PDF document text
  • https://a7ed8af5-5e4a-4eaf-98d7-51655494ca15.filesusr.com/ugd/b5c45a_f40c072736a34654b062106cdf926f70.pdf?index=trueIn PDF document text
  • http://duxegejuw.atwebpages.com/nikon_d40_owners_manual.pdfIn PDF document text
  • https://858e1da1-ad31-4e5b-aec0-89c59c6c71f6.filesusr.com/ugd/6240f8_c58c20f43cfa4f348c0fa0304dd4a1e9.pdf?index=trueIn PDF document text
  • http://rabelinowizufe.myartsonline.com/ap_psychology_memory_test.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.