Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://infrive.ru/pbw?utm_term=gta+vc+setup+download PDF link annotation

  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/9db97cac-c359-441d-80dd-47c5f04ea289/the_blind_side_book_vs_movie_differences.pdfIn PDF document text
  • http://foxobekizax.pbworks.com/w/file/fetch/144467451/91070338114.pdfIn PDF document text
  • http://bijinim.pbworks.com/w/file/fetch/144845958/excel_is_slow_on_windows_10.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/60b31f40-77e1-465e-a523-0200140b4db3/skin_changer_fortnite_chapter_2_season_5.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/55102613-fa98-462d-8f76-f59e12f93152/top_10_town_hall_11_war_base.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/52775e22-73ca-4ec4-b290-648bfc207322/64329487100.pdfIn PDF document text
  • http://luwivaj.pbworks.com/f/85271743809.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8348d310-5a6a-4e88-b492-5d2e9a15aa18/who_was_elton_johns_first_songwriter.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3a396052-3853-4bf5-9757-09261927ec20/16463289320.pdfIn PDF document text
  • http://tukufidanega.pbworks.com/w/file/fetch/144423096/43465779261.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d88f6e9a-0261-415c-b693-34163491746d/without_remorse_book_review.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c1c284ac-d126-4b8b-898e-9d8011d2b83f/how_to_calculate_the_cable_size_for_motor.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d9ff4a61-ace8-425c-827b-891bb2705683/how_to_get_a_replacement_drivers_license_ms.pdfIn PDF document text
  • http://sozevupegufi.pbworks.com/w/file/fetch/144888834/oil_painting_by_color_planet_app.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7dabbe46-8d60-4ac3-8cb2-2e02b8007731/lexatepava.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0805e3b5-4ec7-459e-b2b3-bb186b62cf90/fts_2020_mod_apk_new_transfer_terbaru.pdfIn PDF document text
  • http://saladolu.pbworks.com/f/27595223185.pdfIn PDF document text
  • http://rijunepupuja.pbworks.com/w/file/fetch/144468087/94110833690.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/554357e9-ff54-4612-8481-1549d34424c0/wildgame_innovations_wraith_16_lightsout.pdfIn PDF document text
  • http://sijomirurefi.pbworks.com/w/file/fetch/144706278/soluciones_empiricas_diluidas_concentradas_saturadas_y_sobresaturadas_ejemplos.pdfIn PDF document text
  • http://felinemumivu.pbworks.com/w/file/fetch/144514362/how_to_set_defiant_indoor_digital_timer.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6bb7fbac-83df-4d6d-b896-cd3382d01ccb/holmes_tower_fan_htf3610ar_parts.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.