Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://seumenha.ru/wix?keyword=weller+wxd+2020

  • http://wafixevewitope.mypressonline.com/zitub.pdf
  • https://kerijene.weebly.com/uploads/1/3/4/3/134367262/2122876.pdf
  • https://cdn.sqhk.co/vateviti/aFJhavr/sepegasa.pdf
  • http://wibubalitobidu.22web.org/how_to_become_a_certified_yoga_instructor_in_ontario.pdf
  • http://rulimiwe.22web.org/best_virus_protection_for_android_mobile.pdf
  • http://xedeporib.medianewsonline.com/the_wifes_lament_poem_annotation.pdf
  • http://turajenapadefo.22web.org/bony_mwaitege_imba_audio.pdf
  • http://lazategomid.scienceontheweb.net/how_to_rewire_a_sprinkler_system.pdf
  • http://newobesarejif.22web.org/tavewowixupalijo.pdf
  • https://wufikasuruxur.weebly.com/uploads/1/3/1/6/131636700/6567867.pdf
  • https://cdn.sqhk.co/pilupenemima/Ueigvsb/30920546108.pdf
  • http://www.ascendercorp.com/
  • http://www.ascendercorp.com/typedesigners.html
  • http://goseletew.epizy.com/40102227249.pdf
  • https://fa202315-5cd5-4006-9a99-7c5d4406650e.filesusr.com/ugd/61804c_bd9cfb0e582e4b31a89e7476d7b16492.pdf?index=true
  • http://weguxoxuwaxa.epizy.com/how_to_connect_hp_officejet_pro_8600_fax.pdf
  • https://7afcd0b8-98df-42a4-afe0-9544d44c9539.filesusr.com/ugd/74e9cf_d2a898d439134b5bb74905b8680cb843.pdf?index=true
  • http://rujeziwuxe.rf.gd/53861538892.pdf
  • http://mowowaruxuxizim.rf.gd/asp.net_mvc_tutorial_for_beginners_visual_studio_2019_with_c.pdf
  • http://laxukumelukadut.myartsonline.com/canara_bank_po_exam_paper_2020.pdf
  • https://e20d271a-53e3-41f9-9180-d6cd5f9fd148.filesusr.com/ugd/6cfc61_65a4f08ea54b45c3a9d900b460e5c6df.pdf?index=true
  • https://b913155d-2712-4fd4-bcc6-651970a8c456.filesusr.com/ugd/e39924_9915cf9872c5459fabaf16b3a80d51cc.pdf?index=true
  • http://xipobibupo.epizy.com/tp-link_tl-wpa4220_av500_manual.pdf
  • http://xizokenimufewom.atwebpages.com/rain_bird_5000_mpr_nozzle_chart.pdf
  • http://vetebiba.rf.gd/knowledge_of_the_holy_one_tozer.pdf
  • https://a694a867-b0fa-45cd-b082-7f9abf80b1a7.filesusr.com/ugd/430cb2_26ca805ead9a4884ae1c72eab35f08ec.pdf?index=true
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • http://purl.org/dc/elements/1.1/
  • http://ns.adobe.com/pdf/1.3/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/rights/
  • http://scripts.sil.org/OFL

Open this report in the interactive analyzer, or submit your own file for analysis.