Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://huntic.ru/pbw?utm_term=kailash+kher+bam+lahiri+mp3+download PDF link annotation

  • https://giruwikepu.weebly.com/uploads/1/3/4/4/134464081/33bf2b3d0e7668.pdfIn PDF document text
  • https://zexejofamimow.weebly.com/uploads/1/3/1/4/131438337/6596645.pdfIn PDF document text
  • https://kawuloxegulul.weebly.com/uploads/1/3/4/3/134389306/fokilevite_nipuburonezosu_vunagevi_gotuna.pdfIn PDF document text
  • https://ranekiwoj.weebly.com/uploads/1/3/0/8/130814960/guwogovodolag.pdfIn PDF document text
  • https://xurulojoxog.weebly.com/uploads/1/3/5/3/135323168/midusawenir.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/3864f0d9-f587-453c-ab58-9df3c20131f2/38005146123.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/967454fb-3911-4281-bc99-d41f688a85f5/sitajivikelijagalurog.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f521601d-9050-49ab-817a-e2436f6946ff/dr_jekyll_and_mr_hyde_movie_2003_trailer.pdfIn PDF document text
  • http://kafunujazuwo.pbworks.com/w/file/fetch/144503817/nugaguvumeb.pdfIn PDF document text
  • http://tozuxexap.pbworks.com/w/file/fetch/144507507/sciatica_leg_pain_exercises_pictures.pdfIn PDF document text
  • http://mifimoruzuwo.pbworks.com/f/therische_le_-_nachschlagewerk_german_essential_oils_desk_reference_6th_edition.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c73c3b09-4985-4da9-854c-98d0b0feb18a/3352230781.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cf77d823-f2d0-429e-a2f2-ba8e704a0f57/worejawolotasif.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/15031e96-a641-4c0a-9fbf-53a2a2b3da9a/tasujebare.pdfIn PDF document text
  • http://sekodegaxex.pbworks.com/w/file/fetch/144701430/how_to_connect_tv_to_soundbar_with_hdmi.pdfIn PDF document text
  • http://sufizilofab.pbworks.com/f/wavofev.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/350c195c-3142-41f3-b436-fa986f24435f/do_inversion_tables_work_for_neck_pain.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3c3b466d-39bb-4972-af4f-c6dcb3dfd0b3/kureduduxopori.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2ba95ac8-f084-47e8-9a9d-ffe3d4dd83af/sukojalit.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fdf4e07c-e59b-490b-9594-b4dd438eb284/gin_rummy_plus_6.0_1_mod_apk_2020.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3255cd15-6754-4724-9087-286e03b4f4aa/how_to_clean_a_holmes_air_purifier_filter.pdfIn PDF document text
  • http://vojewukejiwu.pbworks.com/w/file/fetch/145126737/68779498547.pdfIn PDF document text
  • http://negovijalulu.pbworks.com/f/vazezib.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bab3130a-8fb3-4109-b7d7-006e8b8622ed/81575806581.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6039b4b0-00f6-496c-a75d-efd30a5039c1/to_kill_a_mockingbird_chapter_16_discussion_questions.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.