Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• MFA / one-time-code harvesting lure high SE_MFA_LURE
  Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://midufefew.ru/strik?utm_term=honda+fit+sport+2007+battery PDF link annotation

  • https://xufodikufidu.weebly.com/uploads/1/3/5/3/135382923/vagovosiwajivet-duwaxax-popowekus.pdfIn PDF document text
  • https://rodelifefi.weebly.com/uploads/1/3/0/7/130776661/lijovova.pdfIn PDF document text
  • https://garanokuwepo.weebly.com/uploads/1/3/0/8/130874617/da7151126eb4f.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4383924/normal_5fc92aade8773.pdfIn PDF document text
  • https://zinibolaribile.weebly.com/uploads/1/3/4/7/134717470/batarozovi.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4453134/normal_604d66db68b56.pdfIn PDF document text
  • https://fegalovawi.weebly.com/uploads/1/3/4/3/134349911/093780b46f0c21.pdfIn PDF document text
  • https://mofalapew.weebly.com/uploads/1/3/4/3/134307760/4615485.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4372702/normal_5febcf9b7e2ab.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4404122/normal_5fcf3f13581ed.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://49550882-97ce-44db-a38b-6e383bb81149.filesusr.com/ugd/062c90_8714e9fcc18445ce8f0277b11b133ad0.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/224b9b72-ab97-46d9-90d0-7ecc16e0f01c/getting_the_love_you_want_free_download.pdfIn PDF document text
  • https://b5f169ef-6bcf-4d19-a24b-32bdc9dd7a5f.filesusr.com/ugd/2e79a6_e65b0c9f219241c1a48ccc5549b5ed7f.pdf?index=trueIn PDF document text
  • https://356bbf58-84af-4bff-99a9-d03346e46411.filesusr.com/ugd/b5472a_565b431026f84a129e4737b386480bbf.pdf?index=trueIn PDF document text
  • https://bb491b24-4c81-4ccc-8daa-bf1baeb171c2.filesusr.com/ugd/93c935_29d2f53ec48d4ba8af7dc434de9b491f.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/fodose/chevrolet_sonic_2014_lt_manual.pdfIn PDF document text
  • https://s3.amazonaws.com/sikuva/40668910479.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b563d61e-156b-44fb-b7cb-c4a3a092750e/all_clad_6.5_qt_slow_cooker_ceramic_insert_replacement.pdfIn PDF document text
  • https://s3.amazonaws.com/zesixefe/employee_contract_form_sample.pdfIn PDF document text
  • https://b1c30c75-ab46-439a-884d-3836ae4b8a49.filesusr.com/ugd/2d1648_2ea09164841b41a68b570cdda88cca07.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/e8c99a48-3825-43a4-a800-78f89260d87b/famous_french_phrases_with_meaning.pdfIn PDF document text
  • https://s3.amazonaws.com/jevedijadiki/thinking_mathematically_7th_edition_chegg.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.