Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dafemum.ru/strik?utm_term=petsafe+wireless+collar+troubleshooting In PDF document text

  • http://rte-ita.fun/gixedavodojw5n5.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4488315/normal_603fe8f6d9350.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4449775/normal_6001c8a4daaab.pdfIn PDF document text
  • http://kataeta.club/febokelorevuduxo5xypl.pdfIn PDF document text
  • http://form-lnstagramverifiedbadges.com/common_core_math_problem_solving_4th_grademe96v.pdfIn PDF document text
  • http://form-lnstagramverificationbadge.com/vox_vt30_amp_pricet160r.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4393364/normal_604631ef907b5.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4486743/normal_60406daea7630.pdfIn PDF document text
  • http://rat-red.space/gujejise11kmw.pdfIn PDF document text
  • http://solent.bar/active_release_technique_muscle_knotswo1yt.pdfIn PDF document text
  • http://secureappeal.com/dudasexiniotgx.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4406482/normal_5fcc9f0ce434a.pdfIn PDF document text
  • http://legendarycraft.ru/narozazamoxewobomurujowiz2z4r.pdfIn PDF document text
  • http://martakkord.ru/99446288596akph3.pdfIn PDF document text
  • http://ergors.space/26458315766bnx4p.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4390995/normal_601718dbbef76.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4459164/normal_6024cda7dee34.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://b7e73dfe-ad35-4791-b4f7-7500f5b7882c.filesusr.com/ugd/bc79a4_5f7a8cfb665746a080ad46dc91b12cfc.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/12257548-ad7f-4865-8b02-77de05e705d8/evangelios_apocrifos_de_santo_tomas.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/11038b65-e3b9-4fb7-8487-09862504d1f5/does_weight_watchers_provide_meal_plans.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c855c773-d429-4fd0-a286-e48cdc585564/maytag_bravos_mct_washer_not_spinning_correctly.pdfIn PDF document text
  • https://76bf09fe-c378-4d6f-baa9-beaf48595a8b.filesusr.com/ugd/61567a_426dfb8914fd4f899a8e4b2ac107299e.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/9e3a73a7-511c-4654-82bc-c469616bb844/nodivepudoxosomurifados.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6c9a2a0c-e4f7-4d30-be4f-9b65237347f4/how_can_i_make_xfinity_my_homepage.pdfIn PDF document text
  • https://1f53f175-067f-4140-b001-f66bebc9855b.filesusr.com/ugd/c711d8_e166281f16c44df5a0b57e56af899cd7.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.