Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Invisible PDF links to CAPTCHA-themed web lure high PDF_CAPTCHA_LINK_LURE
  PDF contains invisible clickable link annotations that point to a CAPTCHA/capcha-themed web path. This is a common phishing and ClickFix-style routing pattern: the PDF itself is inert, while the linked page performs the credential prompt or fake verification.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://baarspo.ru/strik?utm_term=effective+half+life+of+technetium+99m PDF link annotation

  • https://dupopawo.weebly.com/uploads/1/3/4/6/134652833/xutug-pipuk-lurudabawibe-biboxekoruziwe.pdfIn PDF document text
  • http://waxedeb.getenjoyment.net/7th_grade_math_brain_teasers.pdfIn PDF document text
  • https://natadafupekex.weebly.com/uploads/1/3/1/8/131856288/sowuraz-pepigozofeda-vixagones.pdfIn PDF document text
  • https://kenitavujene.weebly.com/uploads/1/3/5/9/135977886/sexaxi.pdfIn PDF document text
  • http://rafupufubed.mypressonline.com/kisarezemezama.pdfIn PDF document text
  • http://zuraleres.mywebcommunity.org/3d_max_interior_design_tutorial_free_download.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://d6504552-49b0-4b7d-b1ff-94f9e1082b83.filesusr.com/ugd/1f0558_480f0485f92448778cf5d728c7d8b773.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/9c2d7a1c-9d49-43a8-b149-d0df5531eb66/zezafokobinobib.pdfIn PDF document text
  • https://79e8b926-cc52-4cef-90ae-68e3990d752e.filesusr.com/ugd/694d5d_1c8f6ef754104c15879573e96e9794e3.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/6b72e80a-d939-4993-9a45-3dc649b351d3/61036055834.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3942e57e-1998-42bb-a67a-11b6d12a9c86/wordpress_admin_login_captcha_plugin.pdfIn PDF document text
  • https://148d48ef-a78d-4e34-a4d2-755cfbac042a.filesusr.com/ugd/ccca9b_8aeb11a49b3d4c3db157ebddbaad7b93.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/76752524-dbf6-48b8-ab47-9861bc900550/womadagotegeje.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4a5a1532-0dd6-40e5-9d0e-6688bc81b1a1/85048689256.pdfIn PDF document text
  • https://8bbfbdb8-1895-4472-a1c6-9e834ce25a60.filesusr.com/ugd/7deb27_6fa1c07f2b284e1bbc9fcb792ac8e94f.pdf?index=trueIn PDF document text
  • http://nimanexobubibub.onlinewebshop.net/28108827912.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6ecd81b9-21bc-4bf7-b073-d5089b78b91b/26440619747.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/261929f6-c013-4187-ba8b-60b7dd51bf9a/practical_machine_learning_course_project_prediction_quiz.pdfIn PDF document text
  • http://kuxemozoxabonag.onlinewebshop.net/26611504853.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cd17cab9-29ab-4572-a2a0-94cd62648744/jatuxurutaj.pdfIn PDF document text
  • https://5b3fc17b-a4fb-4144-9a53-ff617e35bc6a.filesusr.com/ugd/696117_4ac9f7b2e0cd410c916afa86b8af4716.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/56e2f428-408f-4f39-a756-abf6e47f4c2d/11062389245.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.