Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://midufefew.ru/strik?utm_term=what+order+does+the+flowers+in+the+attic+series+go PDF link annotation

  • https://ruzudagozigiwis.weebly.com/uploads/1/3/5/3/135394236/xedapubukulixo-kopap-kozobegosulo.pdfIn PDF document text
  • https://cdn.sqhk.co/jiluputumusi/cij2pjb/doom_patrol_trailer_season_1.pdfIn PDF document text
  • https://cdn.sqhk.co/fenazijeguk/heXfeia/wafefokujalidonowizeguzu.pdfIn PDF document text
  • https://cdn.sqhk.co/tenotitur/difEbja/color_by_number_animal_worksheets.pdfIn PDF document text
  • https://kedaregedowe.weebly.com/uploads/1/3/5/3/135321867/c48ec5edb1711e.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4496812/normal_605b6510cc4dd.pdfIn PDF document text
  • https://cdn.sqhk.co/wifinalimow/22RDhcS/57400240306.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4426558/normal_6061427748873.pdfIn PDF document text
  • https://cdn.sqhk.co/netimupoxojo/HNz4jf6/nba_g_league_ignite_roster.pdfIn PDF document text
  • https://zudesamuz.weebly.com/uploads/1/3/4/6/134689191/4940667.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/ef275f04-949a-480c-97c8-645a0e3f6ac1/92038815109.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/85c0ab7f-5a43-4c8f-9fd6-7cbf323ee7e0/24705720914.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8d970ce0-1067-41cd-8a64-dd5fda39a150/wavibokifadedajuxobifisap.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b2aca118-f75b-40ab-b008-f943bda4285f/how_to_program_rca_remote_to_insignia_tv.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9ce86ab5-dfce-4ba3-90c5-8961a9546062/63093808782.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5273bc50-3f9b-412f-9f5b-8e821280fe36/what_is_classic_style_in_interior_design.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f4c6d7c6-2815-4f52-a950-c65216d6b840/pixawimoka.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/de516454-85fc-4da8-a312-9388f7bd13fa/is_hp_envy_4500_a_laser_printer.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/61824840-e6a0-4ccb-9e42-4b6c822fa813/ww2_us_army_uniform_colors.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/af083dfd-ea5a-423a-a403-d002b80e977c/how_to_do_finishing_stitch_on_needlepoint_belt.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5d09d08d-a6d8-4d9c-975a-3785aaee029a/the_thrill_of_the_chase_poem_found.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8fc06c3a-7b26-428a-b68f-fb6b6e49636b/mitsubishi_mr_slim_error_code_p8_00.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7ba8a20a-a5e3-4e7f-8ca7-dd53f7b482a0/61170144803.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.