Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Brand-impersonation credential phishing lure critical SE_BRAND_CREDENTIAL_PHISH
  Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: action link to abused redirector https://nupadosizekibu.weebly.com/uploads/1/3/4/5/134597568/wudexixaxinavazose.pdf.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://fokemale.ru/strik?utm_term=how+to+fix+bose+3+cd+changer PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4493600/normal_603b2a51774ad.pdfIn PDF document text
  • https://nupadosizekibu.weebly.com/uploads/1/3/4/5/134597568/wudexixaxinavazose.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4456135/normal_6005e265d5bac.pdfIn PDF document text
  • https://lixubirenolona.weebly.com/uploads/1/3/4/6/134669397/padef-wizewi-takofomog.pdfIn PDF document text
  • https://mejotozoferu.weebly.com/uploads/1/3/4/8/134866749/8967821.pdfIn PDF document text
  • https://nitevafatuva.weebly.com/uploads/1/3/4/8/134872456/momokapow-xodevo-xevamag.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4403687/normal_603f1b1585c63.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4486363/normal_6044d4bf90431.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4476274/normal_600980b9c8e49.pdfIn PDF document text
  • https://fuvobavan.weebly.com/uploads/1/3/1/6/131637325/ludosapirelaze_rirel_sazureperibu.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/d15e26be-85f3-4e58-a372-748799874f7a/89623742182.pdfIn PDF document text
  • https://6b54b0b2-91db-43cc-88c8-bbc4f7e20b37.filesusr.com/ugd/a773aa_1c497a29bf9547b8b21b3ecf91fb1341.pdf?index=trueIn PDF document text
  • https://2cfcb734-ec62-4cd9-b61c-03d4762ad765.filesusr.com/ugd/a891c0_45ecfefa28f342b5a36857d56ce3a4f5.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/83544d37-50a8-4860-93a7-9cc858a87ba9/57366626755.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2689a72c-1de9-490b-aa97-11a279607310/robert_fagles_iliad_and_odyssey.pdfIn PDF document text
  • https://ac402fee-74f4-49a6-b5a4-6a03c6a057de.filesusr.com/ugd/b0cd75_fadf19aa3cad47e687caa76330b384fb.pdf?index=trueIn PDF document text
  • https://46d16763-6c5f-4e19-aa2c-3f4071fcbec2.filesusr.com/ugd/26f730_c074f9808ba14d89ac6ca2aadde6bd4e.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/a65da041-1b2a-4054-b87b-a4988aec3a8d/guitar_beginner_chord_chart.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8f88c693-2da9-4aca-a401-d0db678ab603/what_type_of_note_gets_4_beats.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/13e32b90-0c48-484e-af87-95f42d0b6b13/nosiwezukobazagibo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/aee93f41-0b8e-440b-9a78-37d9423f8079/film_directing_shot_by_shot_review.pdfIn PDF document text
  • https://ff4d9611-e7ea-45f2-85d3-f0b464ef817f.filesusr.com/ugd/48f461_68c6934ab50c4eeda1fb1661adaf1758.pdf?index=trueIn PDF document text
  • https://86a9da1b-0b57-4b35-a77a-523886b904cd.filesusr.com/ugd/0d9a50_621044f226bd48f1a8bc58ff80fe63ce.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.