Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://medvor.ru/pbw?utm_term=free+download+aww+tera+happy+birthday PDF link annotation

  • https://static.s123-cdn-static.com/uploads/4384039/normal_5fe4f018bbfb5.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4401697/normal_5fdb90a2b2151.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4414500/normal_60394d32026aa.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4426815/normal_5fd04b15b0f6b.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://jevibufile.pbworks.com/f/peavey_vypyr_vip_2_price.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/49f44814-a4af-4b8e-b20f-cbca1bd4f984/sociology_crime_and_deviance_revision_notes.pdfIn PDF document text
  • http://lakobun.pbworks.com/w/file/fetch/144783687/kabogivizedusakeledab.pdfIn PDF document text
  • http://ludagobef.pbworks.com/f/65724164476.pdfIn PDF document text
  • http://xuwajesorewo.pbworks.com/f/69310124456.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1b1cbfe4-d6cc-4b8d-acf9-0a0c8a08bf19/zezetewuzopofa.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bb950210-09b8-48a4-8caa-0cceab9e26a2/what_is_manual_dexterity_examples.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/07be9dad-b83e-4bcd-a6b8-b1de66b612e1/jeu_de_cartes_a_deux_simple.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3781b68c-582a-4537-856e-27b3119943cc/shimano_ultegra_di2_r8070_shifters.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f8ac6284-f8fe-4119-8ff8-b3c159b47c1a/how_long_are_fedex_tracking_numbers_good_for.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cd1c346f-ef71-4a7b-8834-ca59da730259/dimogexadanivatumewiwopu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/02547867-0ebf-4149-b405-563bb98b1ea6/right_triangle_congruence_theorems_worksheet.pdfIn PDF document text
  • http://wamewariz.pbworks.com/w/file/fetch/144866025/kalnirnay_aug_2020_marathi_calendar.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e9a8925f-ff69-420d-ae1d-ec6ceb23f162/kmspico_windows_7_professional_activator_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/00d915ff-835f-4340-b86f-fcbb5b674c21/tezusawedijofan.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/05e3a381-69d4-4150-8970-72f864c06bbb/how_fast_does_a_polaris_scrambler_400_go.pdfIn PDF document text
  • http://wixumip.pbworks.com/f/cecelia_ahern_ps_i_love_you_read_online.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8afc0301-4c6a-4e15-a27b-4d2125e95749/nes_mini_driver_windows_7.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/129cf823-9dc9-4849-ad00-7e0463bb1eb9/krups_egg_cooker_user_manual.pdfIn PDF document text
  • http://ridelox.pbworks.com/f/78014590733.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.