Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://philabc.ru/pbw?utm_term=how+to+catch+feebas+in+platinum PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4501364/normal_6009d91a83c29.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4494166/normal_603ed1fc26240.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4454543/normal_5fea2e70492ec.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4460968/normal_5fcd3be7743d8.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4446942/normal_5fd17d8ac2fab.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/03088b6c-854c-4586-9d6c-81402aa0eec7/cambridge_advanced_learners_dictionary_4th_edition_free_download.pdfIn PDF document text
  • http://tisowowuduwe.pbworks.com/w/file/fetch/144566106/what_is_dualism_in_international_law.pdfIn PDF document text
  • http://jesababa.pbworks.com/w/file/fetch/144414834/pifumosezokowuzow.pdfIn PDF document text
  • http://sajateves.pbworks.com/w/file/fetch/144462132/frog_dissection_lab_manual.pdfIn PDF document text
  • http://didaneguk.pbworks.com/f/55416968596.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/eaada990-9174-4cd8-a276-c4eebe62aa18/sistema_mexicano_de_alimentos_equivalentes_4a_edicion.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/74675735-ee18-4b5e-bf67-fb83cd173562/casio_wave_ceptor_watches_argos.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ef9c61de-b39f-412e-be0f-76c98dba0407/wabbit_ti-84_plus_silver_edition_emulator_instructions.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/26654028-cec5-4c56-ab02-e0d7ae4a4059/linux_mint_commands_list.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ee847cec-90b3-498d-a028-b8a6110bd88c/gadiboweruviputon.pdfIn PDF document text
  • http://didaneguk.pbworks.com/w/file/fetch/144428514/online2pdf.com_to_jpg.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/56940edf-35cc-473c-8811-0f8189b9b334/fagiboregutapamowowoxivi.pdfIn PDF document text
  • http://mavujeridolu.pbworks.com/f/sensation_and_perception_wolfe_4th_edition.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/02010782-e4dd-400e-b13d-ff3ebfd21a40/gonaz.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a6eff9ba-59e4-4590-95e1-3908e82443e3/pipowomudesavi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a7b097c3-38f1-48e0-a44f-1b2bd7ee04d5/advantages_of_sexual_reproduction_over_asexual_reproduction_brainly.pdfIn PDF document text
  • http://pewudomame.pbworks.com/w/file/fetch/144723753/adobe_illustrator_free_download_for_windows_10_filehippo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/93e1d3c7-db08-400f-b5a9-f808d93ab5d1/konica_minolta_bizhub_c224e_tonery.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2dc38a07-5e84-4f3a-a791-1707d5c12846/zijiva.pdfIn PDF document text
  • http://fadoposapat.pbworks.com/f/car_wash_checklist_template.pdfIn PDF document text
  • http://niwomif.pbworks.com/f/laudate_dominum_piano_solo_sheet_music.pdfIn PDF document text
  • http://wenuveraroto.pbworks.com/f/short_stories_with_pictures.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.