Malicious PDF — malware analysis report

Heuristics 8

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Urgency / deadline lure low SE_URGENCY_LURE
  Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
• Fake invoice / payment lure low SE_INVOICE_LURE
  Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://seumenha.ru/strik?utm_term=what+charger+does+jbl+xtreme+use PDF link annotation

  • http://pusewuvi.medianewsonline.com/mofeluju.pdfIn PDF document text
  • http://rasipafus.getenjoyment.net/lewivokud.pdfIn PDF document text
  • https://s3.amazonaws.com/gixawetopoli/sisitigawoderuzaludikeze.pdfIn PDF document text
  • https://rusakubasarozu.weebly.com/uploads/1/3/4/2/134266120/zipojiv.pdfIn PDF document text
  • https://s3.amazonaws.com/zesotat/45324968524.pdfIn PDF document text
  • https://s3.amazonaws.com/dusined/gcse_science_questions_with_answers.pdfIn PDF document text
  • http://lazokiwumemo.mygamesonline.org/oxford_discover_3_workbook.pdfIn PDF document text
  • http://moxawunanenubop.sportsontheweb.net/adjectives_english_french.pdfIn PDF document text
  • https://lififamofupuge.weebly.com/uploads/1/3/4/3/134317858/lemobepemibejajaku.pdfIn PDF document text
  • https://s3.amazonaws.com/fovezewi/71321295730.pdfIn PDF document text
  • http://zagavexakagin.mypressonline.com/hepatic_encephalopathy_2020.pdfIn PDF document text
  • https://s3.amazonaws.com/rekorewexidiwo/tunepabazixesivajowiku.pdfIn PDF document text
  • https://dutajedi.weebly.com/uploads/1/3/5/9/135964159/3180220.pdfIn PDF document text
  • http://gixitetopes.scienceontheweb.net/kezotowor.pdfIn PDF document text
  • https://zupalopozaguri.weebly.com/uploads/1/3/2/3/132302876/34a2f2b2b.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://161abad2-7de2-49bb-9904-d6e2a620a662.filesusr.com/ugd/2eec94_6f5d3564ad3d4acca883d9a9b10e8110.pdf?index=trueIn PDF document text
  • http://bumurulepowele.myartsonline.com/rains_of_castamere_violin_sheet_music.pdfIn PDF document text
  • https://d4e73f68-9870-4c81-be0c-0a6dd7607cd2.filesusr.com/ugd/6f53d7_2dd102bd3fd24c21bf79cdd591c9c600.pdf?index=trueIn PDF document text
  • https://3e1af3dc-cf37-4f58-935d-0a6065bc5ce9.filesusr.com/ugd/3ca236_455f5b32c30e4b31abc636af613bac55.pdf?index=trueIn PDF document text
  • http://galojuxutiwas.epizy.com/93965568458.pdfIn PDF document text
  • https://e7f45dcf-1957-410e-85b1-216e85a225c4.filesusr.com/ugd/a2c2bc_07feb9eed13246519eb0be8db277b4c1.pdf?index=trueIn PDF document text
  • http://xurosuforudev.atwebpages.com/55446397685.pdfIn PDF document text
  • http://wamulax.epizy.com/pivumosagulujireg.pdfIn PDF document text
  • http://xexovigir.epizy.com/firisabilavamuzuribug.pdfIn PDF document text
  • https://459ec6dd-5b69-4322-a182-74abbfaa0e48.filesusr.com/ugd/221eaa_0fd6eb6c2e554cc4a8679b405fe8f200.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.