Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://philabc.ru/pbw?utm_term=website+project+brief+example PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4457590/normal_601359787a086.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4491705/normal_6067f2da1ce79.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4426972/normal_60532a6eed202.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4374372/normal_5fc57ccb6c25a.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4468294/normal_60ba85b6c250a.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/538e5a2f-13f7-412e-87bd-29f1a03f5a0d/what_does_it_mean_when_your_car_says_service_airbag_system.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8f004e50-7c24-4204-8cb2-bc79a82d49c7/63211599748.pdfIn PDF document text
  • http://pesivop.pbworks.com/w/file/fetch/144890949/nadosenu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c60522d7-58fe-42b9-a071-b17448fb495f/how_to_replace_battery_in_apc_ups_550.pdfIn PDF document text
  • http://jivevisubido.pbworks.com/w/file/fetch/144642285/can_you_play_minecraft_java_edition_on_a_chromebook.pdfIn PDF document text
  • http://rupebaxo.pbworks.com/f/adobe_after_effect_2019_torrent.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2b71bf47-aa6d-4f20-853e-ecd8bbf743c0/krispy_kreme_chocolate_glazed_donut_nutrition_facts.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ea45e297-697c-4a4b-9520-9d2f8e8a1ae7/nirezuwukojipepasawuru.pdfIn PDF document text
  • http://fenetikuro.pbworks.com/w/file/fetch/145030413/plants_vs_zombies_heroes_mod_menu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0a36e205-a937-48df-a854-4dbecdb59d21/starting_strength_over_40.pdfIn PDF document text
  • http://radejaki.pbworks.com/w/file/fetch/145173198/urban_tale_full_movie_online_free.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/48f85e87-448f-42ac-a6bd-5379fef2930b/sisatutexodomogadigegajod.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f24f2997-413f-4dab-9906-3f4b456206d8/why_does_my_verizon_jetpack_say_no_service.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/adb3189f-cdc6-48d0-a023-e2f81dcfc90d/na_step_working_guide_step_4.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7a4e8e8e-aede-47fc-94be-890843d9ba12/12988433893.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0ab9bbb4-925a-43f4-8527-e53a931b687a/78625222675.pdfIn PDF document text
  • http://didaneguk.pbworks.com/f/50989855438.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/39467998-9453-4b3c-9665-220aa1909980/ximokenobubalivixu.pdfIn PDF document text
  • http://fevuxowina.pbworks.com/w/file/fetch/144806811/kugigatiliruniriwaxokepub.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/89a4649f-e99c-4f27-81b9-083bd0b1e341/45121606260.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.