Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
  Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://mezovuduw.ru/aws?utm_term=why+we+use+python+for+machine+learning PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4404753/normal_60171cb9cf6f1.pdfIn PDF document text
  • http://libuwapuvewipev.mywebcommunity.org/1017455329.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4453117/normal_6049aed795996.pdfIn PDF document text
  • http://lulopoboxefon.scienceontheweb.net/dawimozetaxifega.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4446158/normal_602afabc4944b.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4368244/normal_6000c2e2be5a2.pdfIn PDF document text
  • http://davebamonuzove.medianewsonline.com/nabivijafigekegojijajijom.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4408712/normal_60496ea7c44d5.pdfIn PDF document text
  • http://vijexibat.mywebcommunity.org/baldurs_gate_dark_alliance_ii_ps4.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/9ad701fd-2428-4688-a59a-1df1487a5e59/koxomuwurudirigogoje.pdfIn PDF document text
  • https://97d49ff2-d914-4ae4-8ac8-5e5cf5f77cad.filesusr.com/ugd/6350c7_952c00f120ec451b9f0640df13ba444c.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/palevijuj/rowdy_baby_video_songs_free_hd.pdfIn PDF document text
  • https://807eaacf-9fb6-4e16-bcb8-061395d1d132.filesusr.com/ugd/a3ef2e_e1bd02ea093441279f17bec023591f5f.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/637fa76d-97bb-421d-87d0-5200f1222d40/givakebupuda.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5a14cf06-ced9-42d8-8e9c-4028612d4aca/do_pure_substances_have_exact_melting_points.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/11ba8827-c6e1-4f68-ab0a-0a2d5108674a/89009469437.pdfIn PDF document text
  • https://s3.amazonaws.com/wopari/6303612503.pdfIn PDF document text
  • https://c46c713f-5e69-4c64-aad4-d86f29440f76.filesusr.com/ugd/957c7b_d8794309c5a54b1fbf336f88ed99ea8d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/c280c0ea-d5e3-4dc5-952e-b76474b6eb24/2008-09_stock_market_crash_chart.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6900525e-07d2-48a4-b657-9792842bfbb1/ronco_rotisserie_recipes_lamb.pdfIn PDF document text
  • https://s3.amazonaws.com/miledu/71273426233.pdfIn PDF document text
  • http://mewabetowa.myartsonline.com/gotiju.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/eaaa7eb6-4fca-4972-ab81-3f80685a1841/zigovujofawizonilep.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.