Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Fake invoice / payment lure low SE_INVOICE_LURE
  Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://nipisod.ru/wix?keyword=swtor+sharpshooter+build PDF link annotation

  • https://xemizumelisiga.weebly.com/uploads/1/3/1/8/131856695/f79ab306b647fe2.pdfIn PDF document text
  • https://posuzelivoj.weebly.com/uploads/1/3/4/8/134869480/827c057ce4331f.pdfIn PDF document text
  • https://bawigadumifop.weebly.com/uploads/1/3/4/4/134494387/2009893.pdfIn PDF document text
  • http://berozava.iblogger.org/zobatipixipotaduwujuvo.pdfIn PDF document text
  • https://nofakuxuwuxow.weebly.com/uploads/1/3/4/6/134684799/salebowalaj-kazinif-lapavadenano.pdfIn PDF document text
  • https://xabomipa.weebly.com/uploads/1/3/4/4/134484571/7605210.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4500425/normal_603bb97b8dd23.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4372707/normal_5fdaea79bbe2a.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://nesilinezet.epizy.com/online_reading_comprehension_test_kindergarten.pdfIn PDF document text
  • https://40ba1f7a-6e91-49bb-bbb8-dfbb40a2bc60.filesusr.com/ugd/22bf55_d7e7a9fb9670429ea496b47209be80e6.pdf?index=trueIn PDF document text
  • http://bepapogijarepub.rf.gd/email_address_owner_information.pdfIn PDF document text
  • https://7605c768-a471-4169-85a9-0dab509fd250.filesusr.com/ugd/20ab23_632c5d142c7048cdb2926bb3f4fc070b.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/8bd987a4-5b4b-499e-b452-6fb0018a729b/honda_generator_2000_watt_price_in_kolkata.pdfIn PDF document text
  • http://sukepavudopuje.epizy.com/aeroplane_new_punjabi_video_song.pdfIn PDF document text
  • https://ec560393-4650-4708-bf0c-d08fceb8458c.filesusr.com/ugd/ca69db_b416668d47f44074a0f3df7ee5232380.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/771eaaad-c0dd-44b3-a8ae-7a4feaaccf24/can_you_lose_weight_in_crossfit.pdfIn PDF document text
  • https://95043331-d9de-4498-ad98-35b8ac3ee23f.filesusr.com/ugd/5740b2_5ccbb93780f341f587460a31cec65987.pdf?index=trueIn PDF document text
  • http://befakugidutoj.rf.gd/the_aviator_full_movie_hd_popcorn.pdfIn PDF document text
  • http://xeravujowa.epizy.com/12827792106.pdfIn PDF document text
  • http://supetok.rf.gd/54655167739.pdfIn PDF document text
  • https://9ef77391-fdd1-48d8-ba15-364b07375333.filesusr.com/ugd/ebefdf_00d78cf39a4e4099a20913bc958a7ffa.pdf?index=trueIn PDF document text
  • http://bemisiba.epizy.com/34701614574.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/aaa60fdc-f343-43a6-8da3-ea0fc849b12d/73603077839.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ddfe9511-91e2-45a0-b7c3-595a42cd32f0/bosch_dishwasher_silence_plus_44_dba_parts.pdfIn PDF document text
  • http://pebimomedunuzux.epizy.com/vakesel.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.