Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://midufefew.ru/123?utm_term=anonytun+vpn+apk+indir PDF link annotation

  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/22487340-124b-424c-a0d5-ddfc247802dd/hisense_smart_tv_app_store.pdfIn PDF document text
  • https://s3.amazonaws.com/jepinebawo/janatha_garage_full_movie.pdfIn PDF document text
  • https://s3.amazonaws.com/xezonijida/60305271634.pdfIn PDF document text
  • https://s3.amazonaws.com/tajimipojimo/figabapuvovobof.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0220b604-fbdd-4fff-a4f8-2ebee96071e4/what_does_kingdom_by_the_sea_mean_in_annabel_lee.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/06b3fdc6-4a8c-448b-ac2a-334190fba165/guwumixopup.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/70d0349d-0c8a-407f-b13b-cc822723b61b/sugurijox.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/76816b5e-d259-445b-9f99-2e3d3cf45f51/46264823154.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/93c49d6b-b092-440d-8d1f-e8dbe855908c/celestron_astromaster_90_review.pdfIn PDF document text
  • https://s3.amazonaws.com/vitelitubovuluj/53149473134.pdfIn PDF document text
  • https://s3.amazonaws.com/ronatiduzoxij/65382802586.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4cd23e26-e27a-435a-ad6f-b42ea471310b/trail_tech_vapor_manual.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0e95b46a-3165-4724-bed9-ad72c30b1b47/was_the_great_society_good.pdfIn PDF document text
  • https://a540aa65-2eb1-4ac3-86d0-bf6a54daac96.filesusr.com/ugd/2d797c_51d5727f8c2b4614af805fc73f408fd1.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/nojemi/fixilonomamawodizedofeze.pdfIn PDF document text
  • https://f1e11ea9-a931-46ad-af30-391325c877dd.filesusr.com/ugd/423518_a68bafb2217b4ff6af5e108e417646e2.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/71e96e06-277f-4eb0-96a1-3b45bcf996ca/sefapenoposaxabupu.pdfIn PDF document text
  • https://s3.amazonaws.com/fibesezati/blockchain_real_estate.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4e811399-9fb8-4b88-b7ec-8b336f69d604/wurawen.pdfIn PDF document text
  • https://s3.amazonaws.com/rutufokedizon/the_dawn_wall_imdb_parents_guide.pdfIn PDF document text
  • https://s3.amazonaws.com/fejenijovekozu/nexelisafi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a5e6eb0b-c8c3-4897-8f3d-8b59414f57e2/bovujivazu.pdfIn PDF document text
  • https://c03439ef-6557-4199-865e-586791a52b6c.filesusr.com/ugd/6bb4a2_a8101346c4954a469cec7960b340a3f4.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2aafd67e-3d9d-4248-9e2a-4fa165562758/nj_residential_lease_renewal_form.pdfIn PDF document text
  • https://20996a60-9695-4f45-8fdb-44bdc783da55.filesusr.com/ugd/c57cae_36e76f187ff14680a8050cf2daae7186.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/99087b1c-39ed-457e-aded-92383c8f5af5/zusonojubop.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.