Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Callback phishing phone lure medium SE_CALLBACK_LURE
  Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://druttle.ru/award?keyword=gray+s+anatomy+book+pdf+upper+limb PDF link annotation

  • https://vofodiwe.weebly.com/uploads/1/3/5/3/135350815/8ab2e25a56.pdfIn PDF document text
  • https://lefafikof.weebly.com/uploads/1/3/0/9/130969708/xagokuxojavev.pdfIn PDF document text
  • https://nozubewow.weebly.com/uploads/1/3/1/1/131164313/bc80746d0d.pdfIn PDF document text
  • https://fewojejano.weebly.com/uploads/1/3/4/3/134348079/4690292.pdfIn PDF document text
  • https://vawudida.weebly.com/uploads/1/3/4/8/134890241/4467575.pdfIn PDF document text
  • https://wajevubal.weebly.com/uploads/1/3/4/6/134687537/1156285.pdfIn PDF document text
  • https://gazumewus.weebly.com/uploads/1/3/4/9/134901575/5272597.pdfIn PDF document text
  • https://xasigebopij.weebly.com/uploads/1/3/0/7/130775268/nudig.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/32a99a6c-af02-42ba-96ea-2ee738d789ca/78004917073.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a6bd93d3-7f70-4728-88ef-b83542022e94/transcendental_meditation_training_near_me.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e21b0897-f232-4cdf-9944-3c114fb0698a/385212458.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9688aed1-541c-4088-b4b1-5fd4d2da2b3b/portrait_photography_poses_female.pdfIn PDF document text
  • https://s3.amazonaws.com/vosimalume/fejeluxojukit.pdfIn PDF document text
  • https://s3.amazonaws.com/wokesabisevo/download_playstation_2_emulator_apk.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/00001751-341e-4a29-8560-116351b4ae9d/how_to_upgrade_items_in_a_link_to_the_past.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c37d1468-7f1b-4466-805e-cf602b1b708c/how_to_sketch_derivative_graph_from_function.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f50bf442-1250-402a-912b-bfa4d92b90a5/tatazi.pdfIn PDF document text
  • https://s3.amazonaws.com/tonemakopinibem/41736994101.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a0cb75f2-3b29-471a-bf81-23e1bde0604e/will_there_be_a_season_6_of_magicians_on_netflix.pdfIn PDF document text
  • https://s3.amazonaws.com/fadupazageraf/18968809309.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/aa3cb313-98c6-431a-b350-47302d5bec58/learn_python_programming.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b18f92a6-8be5-41ec-b355-755b5fd5a7bd/toro_724_snowblower_for_sale.pdfIn PDF document text
  • https://s3.amazonaws.com/tuxexi/50738283606.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.