Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Callback phishing phone lure medium SE_CALLBACK_LURE
  Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://botokaw.ru/strik?utm_term=how+to+use+a+stanley+jump+it PDF link annotation

  • https://jawuvufos.weebly.com/uploads/1/3/4/8/134856807/4092173.pdfIn PDF document text
  • https://nunibuzobaga.weebly.com/uploads/1/3/0/7/130740367/429a6f71e9.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4460042/normal_5feda18cb96fa.pdfIn PDF document text
  • https://metidelesaweso.weebly.com/uploads/1/3/0/8/130813592/fukalumalunove-xemun.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4486045/normal_5fd919548fea6.pdfIn PDF document text
  • https://zukodefikarux.weebly.com/uploads/1/3/4/4/134498552/litidosexe-zirolido-toruvatemam.pdfIn PDF document text
  • https://sikukaposarimi.weebly.com/uploads/1/3/5/3/135307882/8194704.pdfIn PDF document text
  • https://pukexomupuko.weebly.com/uploads/1/3/1/1/131164185/7409058.pdfIn PDF document text
  • https://fewanisip.weebly.com/uploads/1/3/2/7/132712603/lowigobatigowek.pdfIn PDF document text
  • https://xakalawuvobovu.weebly.com/uploads/1/3/1/0/131071286/bewipose.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/xomepixo/zaxozujoxezupegi.pdfIn PDF document text
  • https://e824aeac-d22a-4b45-bb3c-17051d6ee04f.filesusr.com/ugd/de60da_62dc9813b6d94edd9d1c5013c75c5a09.pdf?index=trueIn PDF document text
  • https://b5d51143-f34a-4a4f-9265-6917490cb775.filesusr.com/ugd/9f69bd_cb283ce91bba4fb7abe7ae932adcd2a0.pdf?index=trueIn PDF document text
  • https://746420f6-3007-491b-ba72-fd43be5094e5.filesusr.com/ugd/277b62_3ae30723fca34e9c9d441a4e29715395.pdf?index=trueIn PDF document text
  • https://26f2e344-8444-46ea-90c9-5a893bcc2fb3.filesusr.com/ugd/b8c837_32c3982bdb104709b27fe4918616613c.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/gumegulaxi/gingerbread_man_story_sequence_printable.pdfIn PDF document text
  • https://3633ae4e-9acc-45df-885e-1bfa1481cb44.filesusr.com/ugd/e73054_08bf9f4cae014ac788d2089597fdd3af.pdf?index=trueIn PDF document text
  • https://ac09d6fb-20d1-47e2-97cb-2568fc137cdf.filesusr.com/ugd/03dcd4_335d5b550d954fc7a46b900ecf01519a.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/wujapu/employee_performance_evaluation_templates.pdfIn PDF document text
  • https://s3.amazonaws.com/makixibawumebol/what_washing_machine_detergent_does_bosch_recommend.pdfIn PDF document text
  • https://3bdad275-8828-414d-9063-9532e035d791.filesusr.com/ugd/c67d0c_d751bc3accf14525b245217f526c4ebd.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.