Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://nomylo.ru/pbw?utm_term=ilayaraja+melody+hits+mp3 PDF link annotation

  • https://kegovivaxik.weebly.com/uploads/1/3/4/5/134506491/vijesu_wukavobidupum_domagiba.pdfIn PDF document text
  • https://fowowudajij.weebly.com/uploads/1/3/5/3/135312379/6554520.pdfIn PDF document text
  • https://sirunolova.weebly.com/uploads/1/3/5/3/135303996/1803383a556.pdfIn PDF document text
  • https://kepevexin.weebly.com/uploads/1/3/4/2/134234606/2461d.pdfIn PDF document text
  • https://jatasurow.weebly.com/uploads/1/3/4/3/134358583/dd5da36eab2062.pdfIn PDF document text
  • https://gusizamavuva.weebly.com/uploads/1/3/4/6/134629738/7b915e06.pdfIn PDF document text
  • https://ramabubutimelu.weebly.com/uploads/1/3/4/5/134597411/tokesimimudugi-wifokoxofoxejon-xezusibivoxo.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://fedorahosted.org/lohitIn PDF document text
  • http://sofutikajen.pbworks.com/w/file/fetch/144455598/how_to_put_reference_on_capitec_app.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/84e38bed-e2d1-42f8-8342-14a4a42a6b32/tulebanusalovirasitexuxi.pdfIn PDF document text
  • http://pugaxigodaka.pbworks.com/w/file/fetch/144943284/38346511338.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/67182bf7-f8a6-4465-a48b-f2eef649c9ac/wabatexapisojobujikirad.pdfIn PDF document text
  • http://tejudafo.pbworks.com/w/file/fetch/144460059/verbs_quiz_for_grade_2.pdfIn PDF document text
  • http://fepewuwakow.pbworks.com/w/file/fetch/144501993/24249949505.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/58351c13-45e6-4089-9e38-a986332754ce/what_size_are_sonic_drinks.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cc93edb9-61d0-4bec-816d-ddee8a8b06c4/las_chicas_de_alambre_in_english.pdfIn PDF document text
  • http://garifukedako.pbworks.com/w/file/fetch/144559722/what_is_ir_extender_cable_samsung_smart_tv.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a4c6ec52-c213-4667-ba7b-aaa9f3a7957d/imr_powder_700x_load_data.pdfIn PDF document text
  • http://jifesepapo.pbworks.com/f/legend_of_zelda_link_to_the_past_walkthrough_bunny.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/65440bcc-a694-4a21-9f31-c831e89ce863/77265664068.pdfIn PDF document text
  • http://funuvutidip.pbworks.com/w/file/fetch/144458469/85424658112.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3e9ce587-fa7c-45a4-9e46-df6a003e83e4/jumunamafuwibidilokiwi.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • https://savannah.gnu.org/projects/freefont/In PDF document text
  • http://www.gnu.org/licenses/In PDF document text
  • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.