Malicious PDF — malware analysis report

Heuristics 4

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://botokaw.ru/strik?utm_term=garlic+mashed+potatoes+recipe+no+milk PDF link annotation

  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/kabisebax/sap_bw_on_hana_tutorials_point.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d902b6c1-d88f-4f81-b61f-bab229392e23/11245649466.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/36e9f1ab-6faa-4ed7-b07b-1f1fc19d74d8/90064691600.pdfIn PDF document text
  • https://s3.amazonaws.com/jenagubadopi/19785268399.pdfIn PDF document text
  • https://s3.amazonaws.com/lekezaru/zuraxewu.pdfIn PDF document text
  • https://s3.amazonaws.com/wusigipufuvowix/airshou_ios_7.pdfIn PDF document text
  • https://s3.amazonaws.com/lixuduwonifa/latamuxezibo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fd34c860-9d3b-40f1-98b6-cae74d8cf42b/canon_pixma_mx922_wireless_setup_mac.pdfIn PDF document text
  • https://s3.amazonaws.com/kexamoxusinixu/49483898499.pdfIn PDF document text
  • https://s3.amazonaws.com/megodipewukitoj/narrative_report_global_handwashing_day.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8f81af12-c393-4440-a3bb-8c3b10253608/latest_group_dance_craze.pdfIn PDF document text
  • https://s3.amazonaws.com/mulerux/cheat_sheet_python_3.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7cecc5a2-3d43-4fd7-9232-902bb5fc151f/divolurenido.pdfIn PDF document text
  • https://s3.amazonaws.com/salosibejodod/boards_and_beyond_cardiology.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e6bbbb38-a36e-40fe-845e-321d2e6c0643/2014_honda_cr_v_service_manual.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/033dc72f-2e8e-469e-ab47-4b104e37cb99/63772322692.pdfIn PDF document text
  • https://s3.amazonaws.com/nonabafat/bindiya_chamkegi_album_video_song_free.pdfIn PDF document text
  • https://s3.amazonaws.com/kefefetafij/sawizisuz.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/01ad61b9-19cc-43a1-a102-d3ecda239f53/nubunenebob.pdfIn PDF document text
  • https://s3.amazonaws.com/biwubeleba/used_sheet_metal_folding_machine_for_sale.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.