Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://medvor.ru/pbw?utm_term=game+mod+roblox PDF link annotation

  • https://zegilaritapedu.weebly.com/uploads/1/3/1/4/131438092/nexesukavopi.pdfIn PDF document text
  • https://watuxiso.weebly.com/uploads/1/3/2/7/132740831/a45fccffcd78c.pdfIn PDF document text
  • https://static.s123-cdn-static-d.com/uploads/4455399/normal_60b325f6c6da4.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4404287/normal_60bed12e39706.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4371509/normal_605a3ac600f62.pdfIn PDF document text
  • https://zulazuxalumino.weebly.com/uploads/1/3/1/6/131606396/xomiratafiresufo.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4422368/normal_60323cac86861.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4452193/normal_5fe2f666dca12.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • http://disisopaz.pbworks.com/f/69828623791.pdfIn PDF document text
  • http://ririgifavem.pbworks.com/f/sun_joe_spx3000_detergent_not_working.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8e6190f5-a11a-48aa-bbe2-3aa20233b9f6/mojapezowapijopefid.pdfIn PDF document text
  • http://rixepal.pbworks.com/w/file/fetch/144508572/asphalt_8_4.3.0j_mod_apk_anti_bank.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b0492bd9-1189-49f5-8b61-e5d23c31964a/24665286381.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/763d4e70-aff7-469f-9829-95c16b091e43/zajorizutaguzefudinu.pdfIn PDF document text
  • http://xuwuziz.pbworks.com/w/file/fetch/144527115/how_many_carbs_in_bacardi_limon_rum.pdfIn PDF document text
  • http://zeratuwolima.pbworks.com/f/29839789380.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e88d4bd5-4398-4910-a8b3-a34d3c646f53/machine_learning_for_absolute_beginners_free_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fc74ba43-de08-4458-ac46-934c2eedd1e4/adobe_premiere_pro_app_free_download_for_pc.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fee28d4c-2f96-4e60-8bcd-e0e2398cb24d/how_to_gift_champions_in_marvel_contest_of_champions.pdfIn PDF document text
  • http://mujefapufefi.pbworks.com/w/file/fetch/144522456/samsung_tv_remote_manual_bn59.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9883e5dc-6d56-4072-a8e1-9b8da4838d3c/kaxuliwizewa.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b4d37222-9019-490c-9000-dd5aa920cd72/what_is_the_5_senses.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/99d18df0-c9af-47d5-adc1-337c0a16aa53/40389942965.pdfIn PDF document text
  • http://sinorodolu.pbworks.com/f/clasificacion_de_retinopatia_diabetica.pdfIn PDF document text
  • http://dodosuta.pbworks.com/f/22945713849.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4a409c07-3d28-4a18-81a4-a5d60f36e09d/everlasting_god_chords_ultimate_guitar.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.