Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Callback phishing phone lure medium SE_CALLBACK_LURE
  Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jacksth.ru/123?utm_term=careem+karachi+app PDF link annotation

  • https://tebukebodo.weebly.com/uploads/1/3/1/3/131381901/4422605.pdfIn PDF document text
  • https://zibataluguxomi.weebly.com/uploads/1/3/1/3/131382491/tizikezibexoxiw.pdfIn PDF document text
  • https://wafetuwiwu.weebly.com/uploads/1/3/4/8/134891974/sareser.pdfIn PDF document text
  • https://vogovolakufa.weebly.com/uploads/1/3/4/8/134874318/3626209.pdfIn PDF document text
  • https://fivoputan.weebly.com/uploads/1/3/1/4/131408393/ce37311a6c.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://11ab4cf5-156d-4417-99e9-5039b2a7eb5f.filesusr.com/ugd/82d61e_0132c349f3c94202a0cf0ef196b8a9fe.pdf?index=trueIn PDF document text
  • https://67dec473-0a9c-497c-80b1-62a4c84c5046.filesusr.com/ugd/0aab01_be1bde0dc64b4b4794c7f67e4a7186b8.pdf?index=trueIn PDF document text
  • https://fad58b31-c538-4d3f-828d-7998eec853b9.filesusr.com/ugd/7e6083_79dc9b5b52d74e268af11103484e50bf.pdf?index=trueIn PDF document text
  • https://ff536187-e25a-4bd2-965b-ff1113cf40b0.filesusr.com/ugd/bfcccc_01360f24a55e45c88ce61bd8be73efc2.pdf?index=trueIn PDF document text
  • https://2a983b51-2e13-4971-8c1f-a5bca3ab4353.filesusr.com/ugd/e1a791_d00fa8ed0880493aa5f381e3a62d3128.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/ca0cd890-4c79-43d7-841f-ba3969ecd761/how_to_read_russian_gypsy_fortune_telling_cards.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/05a5eba3-00e2-4f15-b56a-1c0ecf8db967/brown_bear_brown_bear_what_do_you_see_eyfs_planning.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a0eee116-13d6-466b-80be-e6e497863715/lg_tone_infinim_hbs-900.pdfIn PDF document text
  • https://fb4bdcd3-28a3-4206-a6c3-fb267f511c23.filesusr.com/ugd/0ad562_8fac233c1de245d889487a36ba1b4fb9.pdf?index=trueIn PDF document text
  • http://wovodijulenape.onlinewebshop.net/4415659243.pdfIn PDF document text
  • https://94aa8f26-b07a-4c24-bdb4-4112657565c9.filesusr.com/ugd/37428b_30137c8bea334040be74b2f96c2aca9a.pdf?index=trueIn PDF document text
  • https://368af19b-b9be-4417-8ea7-dfc4611f9fec.filesusr.com/ugd/abd4c0_0ac0d4fe93e34b63b4fe673bdf51330c.pdf?index=trueIn PDF document text
  • https://e20e76e0-8db4-4913-8bb1-e23b4f9b422a.filesusr.com/ugd/237bf7_9b117be5de164d5ab32f8e27fffad638.pdf?index=trueIn PDF document text
  • https://989eff4c-946f-4221-9817-1a8d60f2082d.filesusr.com/ugd/7edf14_00755765ecb74c8aad06a1aa0fbdd727.pdf?index=trueIn PDF document text
  • https://fec450ea-b80f-4746-b851-35139cc02de5.filesusr.com/ugd/53a83b_7e2ee374ea3d4fe3bdb4a161fda711b4.pdf?index=trueIn PDF document text
  • https://dacf5b84-f80e-4bd8-bb7f-22aad20a1cd8.filesusr.com/ugd/285be4_8970219985204370aa7d5dd544c71b98.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/750a1159-078a-4b13-bdd1-7974a1a7d787/titipemube.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.