Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://botokaw.ru/wix?keyword=guide+gear+deer+blinds PDF link annotation

  • https://pebawozo.weebly.com/uploads/1/3/4/8/134865175/zinomefufufe_gisenisefobo_mumegepisuf.pdfIn PDF document text
  • https://cdn.sqhk.co/dufelogaruf/Sc0Hihl/32704285306.pdfIn PDF document text
  • https://cdn.sqhk.co/vixukose/nhbm50C/mars_leisure_football_scores_pool_result.pdfIn PDF document text
  • https://cdn.sqhk.co/naxupowu/Lbhjcge/statue_of_unity_wallpaper_hd.pdfIn PDF document text
  • https://pudawiwut.weebly.com/uploads/1/3/5/3/135342926/80157e59cba11.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/kovibu/1064742140.pdfIn PDF document text
  • https://s3.amazonaws.com/jamuluvuvava/tascam_dr_40x_sd_card.pdfIn PDF document text
  • https://s3.amazonaws.com/gavapozalilup/mixolo.pdfIn PDF document text
  • https://s3.amazonaws.com/tabobujimo/eeg_measurement_cheat_sheet.pdfIn PDF document text
  • https://s3.amazonaws.com/gazivemon/mefimib.pdfIn PDF document text
  • https://s3.amazonaws.com/xesigeze/betway_app_apk.pdfIn PDF document text
  • https://s3.amazonaws.com/zagubip/safe_drive_save_life_report.pdfIn PDF document text
  • https://s3.amazonaws.com/mejados/n_d_r_f_long_form.pdfIn PDF document text
  • https://s3.amazonaws.com/dobikasukavu/date_format_c_dd-_mmm-_yyyy.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3da196ec-da56-4b14-8349-749d96a522c6/the_moses_code_wayne_dyer.pdfIn PDF document text
  • https://s3.amazonaws.com/tuxexi/buell_lightning_xb12s_service_manual.pdfIn PDF document text
  • https://s3.amazonaws.com/zuwimadaneb/aseptic_food_processing_operation.pdfIn PDF document text
  • https://s3.amazonaws.com/fibesezati/45075924790.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a5f27986-e264-495f-a129-a5d8aa3b2907/lord_of_the_flies_chapters_5-8_quiz_answers.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7bf58478-8316-408d-b2c7-3b89d683b62c/quote_in_the_little_prince.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.