Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dafemum.ru/strik?utm_term=domino%2527s+pizza+coupons+april+2021 PDF link annotation

  • https://tabureribe.weebly.com/uploads/1/3/0/8/130813037/5758246.pdfIn PDF document text
  • https://dokakuzod.weebly.com/uploads/1/3/4/8/134884054/nibusigukusolesujami.pdfIn PDF document text
  • https://ruwiwiteviporiz.weebly.com/uploads/1/3/4/7/134767377/5391639.pdfIn PDF document text
  • https://tepukijamuboze.weebly.com/uploads/1/3/5/3/135301813/basin.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/mejifavo/bioscope_mod_apk.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9c81b343-adb8-4ddd-9ec8-3aabde1d9d02/kenmore_gas_dryer_replacement_parts.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f916012f-a7ea-403f-a839-abd389b5c91b/day_trading_with_price_action_galen_woods_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2d81160d-bdbe-4624-b243-be53caf00f7b/photoshop_cs6_for_beginners.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a9979c98-207e-413c-b04a-37def99759ff/45724180969.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1f3e2d83-9fe9-420e-93da-1ff56ac5535d/the_outsider_stephen_king_guardian_review.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1a83b944-3018-4c61-abd1-8575935cf3de/how_to_fix_cross_platform_voice_chat.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b84bcedc-b194-49c8-a088-a84e2b9b76a3/tommy_igoe_groove_essentials_dvd.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/eac4391c-b25c-4dfa-bcd0-1db4e04b6740/2761613366.pdfIn PDF document text
  • https://s3.amazonaws.com/bufexa/40257438143.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0cd0dd9b-8e5c-4af7-94c7-e546e7363e4c/barnett_4x32_illuminated_crossbow_scope.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1fceb349-4bcc-4567-9ad0-25f7ff387749/82376268430.pdfIn PDF document text
  • https://s3.amazonaws.com/pujirageg/no_place_to_hide_movie_plot.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/38d89953-04bf-48f8-ad87-d71adc45f84e/big_little_lies_cast_season_1_ziggy.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/98ef2b0a-3d3d-48cf-909f-4b87c2ea1c14/lomezateronezututewan.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4ec4fa96-5447-4f79-9652-9ae06ca1a65b/celestron_nexstar_130_slt_camera_mount.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9fa4cf29-65eb-4c85-b7b3-a2e95200626f/ge_spacemaker_microwave_parts_door_handle.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f8c070b3-5db7-484c-b276-58a6e39e708e/55146739939.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/19939860-d999-4255-afa8-a5ffa2089e88/bepubegefexor.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a45fec7f-33da-45d3-8e00-48679ab1b28f/vemakivizibabowiwuje.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5a47f378-5f31-4d7f-a88f-7206d0751f54/english_speaking_classes_online.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3236f10f-33de-4811-8d3d-077b79956265/26754062939.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.