Malicious PDF — malware analysis report

Heuristics 4

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ggtraff.ru/123?utm_term=roblox+fly+hack+code In PDF document text

  • https://cdn-cms.f-static.net/uploads/4447450/normal_5fd2534ebf9b3.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4414161/normal_5fd93c6c734c7.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/rujimidujek/android_studio_enable_auto_import.pdfIn PDF document text
  • https://static1.squarespace.com/static/5fc5d2deea4a794d56670281/t/5fcd68ad8a55f2188b8b4a07/1607297198450/sanatorium_meaning_in_english_dictionary.pdfIn PDF document text
  • https://static1.squarespace.com/static/5fc3486312facd59cebc5192/t/5fc4f5e43485235c8661bce2/1606743525365/57606915673.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/aa073d41-f367-4fd5-a379-75528fc88001/jezezavulokoz.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/35f70134-329e-439f-bc8e-397c40873e50/71686026575.pdfIn PDF document text
  • https://s3.amazonaws.com/tobaziw/itunes_gift_card_generator_pc_download.pdfIn PDF document text
  • https://s3.amazonaws.com/julaxel/android_tv_box_s8_max.pdfIn PDF document text
  • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd1a731d5d775a7853633f/1606228595846/drastic_paid_apk_no_root.pdfIn PDF document text
  • https://static1.squarespace.com/static/5fc65d7b5687f52b6ba6648e/t/5fd6eb0b0f11661d4c4005e7/1607920395752/m._u._g._e._n_android_jojo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/af3b4968-009c-4206-ae05-9cb8626428b8/torokofubak.pdfIn PDF document text
  • https://s3.amazonaws.com/sowewazulejewi/free_omegle_video_call_apk.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/93bf007d-d254-4d12-9982-c4294a1cefea/54289671160.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.