Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://nipisod.ru/strik?utm_term=canciones+para+rosario+de+difuntos+pdf PDF link annotation

  • https://meverofukibax.weebly.com/uploads/1/3/4/6/134620555/9648466.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4455390/normal_602875185bd8c.pdfIn PDF document text
  • https://gofabede.weebly.com/uploads/1/3/1/4/131453232/xolavegexilotid.pdfIn PDF document text
  • https://rafafokisot.weebly.com/uploads/1/3/4/7/134738004/54a1d5.pdfIn PDF document text
  • https://sajolunuweto.weebly.com/uploads/1/3/1/4/131407571/5095635.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4455375/normal_6012c8b013ee4.pdfIn PDF document text
  • https://gokejaxax.weebly.com/uploads/1/3/6/0/136056436/momefa.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/b631607a-0525-4869-af8f-48c80b276148/mathematics_textbook_for_class_8_answers.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6d71cab1-3df4-4b19-a6f4-1f577759ae4f/jesus_be_the_center_chords_david_funk.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/590dfa12-d5e6-4dd5-9392-b954c3f8dccd/ea_sports_ufc_3_pc_requirements.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6c95f4f2-91ca-4f11-bf8d-87ff8a1815ee/tokugow.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2454f5cc-7e0c-49fa-ba70-df0c92ef485b/45005249243.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2626a732-ba1b-419c-8774-69656021b2f2/how_to_run_javascript_on_chromebook.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ed3e2dd6-ef27-41b4-9360-24af8da2e9fc/97513886942.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8778d397-323f-47ec-8b53-9747fa427e52/johny_johny_yes_papa_video_free_download_3gp.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/65fdc9d3-edc9-4873-9b89-75d1bec1ebb9/what_is_narrative_writing_style.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2020f540-68df-455a-a0e8-8d1cce797eda/67592735780.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2eeba65c-91e3-4b89-87a4-29c6d3825871/comcast_remote_control_battery_replacement.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/638a8e3e-31c2-4845-8eb5-04a49bcfd713/are_all_hp_pavilion_chargers_the_same.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7c975a62-e275-4d13-9e2f-d7db4d120133/how_do_i_fix_the_red_light_on_my_tp_link_router.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4cb717d0-a427-4ae4-a4d7-f27e25804cca/what_is_the_best_bible_commentary_app.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/df8d089e-e63d-4780-8c57-b0c1b15e05c4/la_times_homicide_report_east_los_angeles.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • https://savannah.gnu.org/projects/freefont/In PDF document text
  • http://www.gnu.org/licenses/In PDF document text
  • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.