Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://catamma.ru/pbw?utm_term=reported+speech+exercises+for+class+10+cbse PDF link annotation

  • https://punelita.weebly.com/uploads/1/3/4/6/134679726/negemeta_jatezuku_bafali_tawojutukoro.pdfIn PDF document text
  • https://milonotupilo.weebly.com/uploads/1/3/5/3/135347339/devuvuvazufunanufowu.pdfIn PDF document text
  • https://vusesuke.weebly.com/uploads/1/3/4/7/134723580/sarivasutojor-renenowu.pdfIn PDF document text
  • https://zafasasuk.weebly.com/uploads/1/3/4/7/134713251/205dfa.pdfIn PDF document text
  • https://dizakevusarebiz.weebly.com/uploads/1/3/4/5/134581037/ae7c9e7.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • http://wamotarirup.pbworks.com/w/file/fetch/144668967/2019_pba_tournament_of_champions_results.pdfIn PDF document text
  • http://sekodegaxex.pbworks.com/w/file/fetch/144600822/tegowusijenojetaxo.pdfIn PDF document text
  • http://ritijix.pbworks.com/f/97814204555.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e92e1f96-8dda-4aa4-9b29-894f944bd791/is_lexus_f_sport_worth_it.pdfIn PDF document text
  • http://nunaruribeg.pbworks.com/w/file/fetch/144615732/6124251123.pdfIn PDF document text
  • http://moxulolo.pbworks.com/f/modals_of_deduction_must_can_might_may_could_exercises.pdfIn PDF document text
  • http://sajateves.pbworks.com/w/file/fetch/144463548/little_seagull_handbook_with_exercises_chegg.pdfIn PDF document text
  • http://wozixokumo.pbworks.com/w/file/fetch/144869715/how_to_be_rich_in_avakin_life_2020.pdfIn PDF document text
  • http://kuzimotum.pbworks.com/f/32382584561.pdfIn PDF document text
  • http://werinenimuta.pbworks.com/w/file/fetch/144523497/autotrader_florida_trucks.pdfIn PDF document text
  • http://ziduzobif.pbworks.com/w/file/fetch/144436620/tyt_basit_eitsizlikler_km_sorular.pdfIn PDF document text
  • http://dusozivelas.pbworks.com/w/file/fetch/144878007/milenge_tumko_to_batayenge_o_sahiba.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/da50a3e2-cc8a-44a9-aaba-078b9e05f55a/what_is_the_best_thing_at_taco_bell.pdfIn PDF document text
  • http://tufukamapaf.pbworks.com/f/bulemakatuzumitida.pdfIn PDF document text
  • http://lomexalipele.pbworks.com/f/34701298812.pdfIn PDF document text
  • http://xetibubib.pbworks.com/w/file/fetch/144425430/49670497187.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9d5096a2-2a01-4df2-869f-a43cf6517165/19732471414.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.