Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://pelibifir.ru/123?utm_term=new+york+unclaimed+property+reporting+requirements PDF link annotation

  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://vikiruji.pbworks.com/w/file/fetch/144687243/how_to_reheat_maggianos_ravioli.pdfIn PDF document text
  • http://wiliser.pbworks.com/f/kaththi_full_movie_download_720p.pdfIn PDF document text
  • http://bowawesup.pbworks.com/f/kurzweil_pc88mx_review.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f65debb1-30b6-4686-800a-1ce949899087/what_is_gothic_revival_style.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f940763c-8ca0-4b1c-9b20-bea86b6004e0/how_to_remove_oracal_651.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/510a2532-90a8-4ca4-9d2a-b8a8df100b47/logitech_harmony_700_supported_devices.pdfIn PDF document text
  • http://negovijalulu.pbworks.com/f/how_does_scout_describe_mrs_dubose.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8f6ba2f9-4d51-4f76-86b5-2d49c2cedff6/financial_mathematics_for_actuaries_chapter_10.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5873523d-7769-4a9a-899d-18b6006cd5a6/josozoguzobomemino.pdfIn PDF document text
  • http://gazumadu.pbworks.com/w/file/fetch/144441228/zudurazab.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/047dfd89-1998-4aea-beb2-79226503e11c/luwinizexud.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6bc7e4c0-c63b-410d-91f6-80ae6f2ed4b8/hamlet_full_movie_1996_watch_online.pdfIn PDF document text
  • http://mavujeridolu.pbworks.com/w/file/fetch/144509613/12011558861.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/05b09cc2-5e39-46d6-9462-ace8495d94e9/sig_2022_40_cal_holster.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e03c9de9-76a9-4b57-aee6-69aab2629d9a/mdr_zx770bn_ear_pads.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c9a0cd00-0576-4392-b2ee-4c8f8458843b/autocad_lt_2019_mac_system_requirements.pdfIn PDF document text
  • http://supijexed.pbworks.com/w/file/fetch/144463311/juegos_educativos_para_nios_de_10_a_12_aos_para_imprimir.pdfIn PDF document text
  • http://zowonixepor.pbworks.com/w/file/fetch/144680745/9523842129.pdfIn PDF document text
  • http://risuxujuvu.pbworks.com/w/file/fetch/144483474/kis_desh_mein_hai_meraa_dil_all_episodes_free_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2c871fd1-a4f9-4195-ae29-817e09b33b64/bipudawerufawasibipifi.pdfIn PDF document text
  • http://jaxonewu.pbworks.com/f/vubawazemoxudum.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5224bab2-83d0-4298-a805-63a413edddc1/prentice_hall_african_american_history_teachers_resource_manual.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d1186ebf-5eed-4b72-a246-98db86018889/what_is_an_180_degree_angle.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0330ed28-b628-4892-8347-b17f56fe77de/what_is_hr_management.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6ebcf953-8bea-4acf-b9bd-f0aef928346e/gmat_prep_course_udemy.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c4337593-1794-4edc-9b1c-ce83d4d2fa95/28339264485.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.