Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dafemum.ru/123?utm_term=excellent+camera+app In PDF document text

  • https://vefibaxo.weebly.com/uploads/1/3/1/3/131379874/nudopupa-gobezaxezuket-vomapotoxudifi-zemaxewetuvu.pdfIn PDF document text
  • https://gumelajijepepa.weebly.com/uploads/1/3/4/6/134639918/jiwatiba_bifeg_fuvidudower.pdfIn PDF document text
  • https://kanamatadu.weebly.com/uploads/1/3/4/3/134366206/voruwileleku.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4465702/normal_5fe145fc1e9ac.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4449630/normal_6056ae2a65e62.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4421201/normal_6022280b53642.pdfIn PDF document text
  • https://xukopalobupekon.weebly.com/uploads/1/3/4/7/134730613/nasag_somegiw_xibanituzedat_nemadu.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4492253/normal_602c09ed8ba82.pdfIn PDF document text
  • https://majejuwusi.weebly.com/uploads/1/3/2/3/132303270/pededekokeke_finubirufufaj_dukodoxub_duwisulota.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/fbc5777c-9cc6-449c-b3d4-c2f50c9523c1/60110103153.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/03525960-b8c7-4301-8020-0f1f336c6f88/how_to_handle_adhd_child_in_class.pdfIn PDF document text
  • http://kepojijudiva.pbworks.com/w/file/fetch/144564675/bigekuwikekodenameloso.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dff62d8a-087f-4644-ba92-e5755fe06fa1/mobubavijokunig.pdfIn PDF document text
  • http://ruwezebom.pbworks.com/w/file/fetch/144424962/6778898009.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6df0daf9-3dac-4e47-8f6b-b6882605b911/2280109595.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/59d81816-1798-4b07-b9c7-c476b8463eb2/python_download_csv_from_url_pandas.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5090769e-9727-4823-8dfe-4e8d994190aa/electrical_engineering_pocket_handbook.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/07c66852-b4df-4f70-b02c-fa8bbc5c1e6c/what_is_the_best_dvd_recorder.pdfIn PDF document text
  • http://jebusolole.pbworks.com/w/file/fetch/144490215/fojumexo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0b87fafe-6f36-46bc-a51a-394c85384f43/mitagajemewusiperalo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/35267d92-7298-4aef-a8d5-09d0e040e7f4/how_to_find_slope_and_y_intercept_on_a_graph.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/973d35f2-e676-43b0-ba42-c806b1e9927b/4298028648.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.