Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Fake invoice / payment lure low SE_INVOICE_LURE
  Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://traffmen.ru/strik?utm_term=where+is+area+code+201+in+florida In PDF document text

  • https://kozewofedira.weebly.com/uploads/1/3/4/8/134899359/sirikuzegu.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/ddad393e-30c6-476c-97fe-c7fb47e1bf0f/mujuzolutugexibinufabusem.pdfIn PDF document text
  • https://static1.squarespace.com/static/5fc0fe386b97992eb55c938e/t/5fc1c77d18e72e5fdb19fa6a/1606535037859/food_chain_and_food_web_worksheet_answers.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/97919aa0-f393-41cd-a123-a8585877a6e2/a_separate_peace_chapter_summaries.pdfIn PDF document text
  • https://static1.squarespace.com/static/5fc4c837cd1e280355ed07ea/t/5fc51c151972c46e3c408968/1606753302620/59916987210.pdfIn PDF document text
  • https://static1.squarespace.com/static/5fc080f7bf71053ccb0e3c67/t/5fc11bf364571256546314e2/1606491123922/a_to_z_appliance_repair_schenectady_ny.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8397e15e-c277-4da7-ae84-dc6ed9cc12f4/slope_unblocked_66_sites.pdfIn PDF document text
  • https://s3.amazonaws.com/zabejuvijolu/97930920333.pdfIn PDF document text
  • https://static1.squarespace.com/static/5fc527a3c6229360ecc88336/t/5fc7fda6f9e8c732d1fd5585/1606942119933/sling_blade_knife_company.pdfIn PDF document text
  • https://static1.squarespace.com/static/5fbffa571c8c7413142c9acf/t/5fc0e3609ee0f32b87734f2a/1606476641958/sidon.pdfIn PDF document text
  • https://static1.squarespace.com/static/5fc0ba3b0a2757459be1f9cb/t/5fc9af9655485c3109aebf6a/1607053208822/52915255140.pdfIn PDF document text
  • https://static1.squarespace.com/static/5fc2c8fa27a199023ac1a380/t/5fc3949d9b1ed035384b4a66/1606653085755/joxuvipivifepis.pdfIn PDF document text
  • https://static1.squarespace.com/static/5fc3051916f6d44b07cc8110/t/5fc9784125b8db61b9b4ccfc/1607039042399/87801437948.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.