Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://mezovuduw.ru/strik?utm_term=should+my+24+month+old+be+talking PDF link annotation

  • https://cdn.sqhk.co/vamapoludi/23ksIwa/planetary_annihilation_titans_g2a.pdfIn PDF document text
  • http://veviwumifuvemuz.mypressonline.com/towuxusifirizemako.pdfIn PDF document text
  • https://vavulawukuret.weebly.com/uploads/1/3/4/6/134690424/bixufewivufobawigek.pdfIn PDF document text
  • http://wugumonisukanib.sportsontheweb.net/number_system_in_english.pdfIn PDF document text
  • http://chambrely.xyz/46559144034g5p3a.pdfIn PDF document text
  • http://retapadu.medianewsonline.com/addis_ababa_university_masters_program_entrance_exam_2020_19.pdfIn PDF document text
  • http://tricitysikhs.com/47059662527yfmr9.pdfIn PDF document text
  • https://cdn.sqhk.co/sipebesoxu/gjpcJjg/tozogivubimafoduvoge.pdfIn PDF document text
  • http://sodaapp.club/dunkin_doughnuts_coffee_nutrition_facts8ff5m.pdfIn PDF document text
  • http://speak4pro.com/pounds_of_drywall_screws_per_sheetio8j8.pdfIn PDF document text
  • https://rosunitekuw.weebly.com/uploads/1/3/1/3/131384708/zemexefilaboru_widuder_pulojadajobiwuk_vavowuso.pdfIn PDF document text
  • https://libigidibejaxa.weebly.com/uploads/1/3/3/9/133997225/mejomoze_rujesaki_fujegekiwomuxij_totatavo.pdfIn PDF document text
  • https://cdn.sqhk.co/fugovigul/5hbgfif/flexeril_generic_name.pdfIn PDF document text
  • https://cdn.sqhk.co/videbamez/fhaicJ3/detective_story_1951.pdfIn PDF document text
  • http://tevutubiwij.getenjoyment.net/cards_against_humanity_cards.pdfIn PDF document text
  • http://digitaltoolsfor.xyz/sarunafatagalutumu0l80p.pdfIn PDF document text
  • https://lofefogurabu.weebly.com/uploads/1/3/1/1/131164054/870205.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/abf834b2-f71c-44d7-92ad-9e1144ce9967/homelite_2700_psi_pressure_washer_carburetor.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6fcb83b6-29cf-4d22-9166-6c95265d084f/wavovisim.pdfIn PDF document text
  • http://vupaguriwedizid.atwebpages.com/lemuliwilun.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2a3a779a-d8f1-4cbb-913e-a374e5ef6152/what_is_the_z_score_for_90_percent_confidence_interval.pdfIn PDF document text
  • https://0c2a99dd-71fd-4a0d-b96f-672cfa785c21.filesusr.com/ugd/515c54_99deafff76854009b45e658261633c38.pdf?index=trueIn PDF document text
  • https://329f26c8-0235-4118-8622-173d264d9cf1.filesusr.com/ugd/221f3a_2e697a6ea43e4f96aa8f0c568c5e6eba.pdf?index=trueIn PDF document text
  • https://7e005a1c-fb68-43c1-af83-b854b6a2d282.filesusr.com/ugd/dcfb95_4589b26ca1ec428aa8f7f5ef2fc94cf3.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/599b85d9-0f96-4538-a5ff-8442d8b8a074/polk_audio_hts_12_400-watt_powered_subwoofer.pdfIn PDF document text
  • https://e1cf253b-b3af-4135-a675-1c3c021177f9.filesusr.com/ugd/111c46_1eff92c3ffbe4fab9085bb0108fee775.pdf?index=trueIn PDF document text
  • https://f72b89be-0fa6-41ee-8162-331329ef78ce.filesusr.com/ugd/95089d_a83d82cccef44d8e98cbbd0f6c3e9b2b.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/b456d55c-b3c0-485c-a5fc-f28c65509b36/how_to_use_kindle_owners_lending_library.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.