Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jottigo.ru/wix?keyword=apollo+physical+and+personality+traits PDF link annotation

  • https://jedunifoxawixe.weebly.com/uploads/1/3/4/4/134458330/7100720.pdfIn PDF document text
  • https://dewokipapofoz.weebly.com/uploads/1/3/2/7/132741709/a346c412e7ca9.pdfIn PDF document text
  • https://duxuxapuxud.weebly.com/uploads/1/3/5/3/135332588/pusuwodavenena.pdfIn PDF document text
  • https://jafadunew.weebly.com/uploads/1/3/4/6/134632108/d35be043f533c7.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://d25e5d79-f3dc-43ab-8538-58f2f4730235.filesusr.com/ugd/898300_d143ce5625a14c3c9f6cfdd50eedeb92.pdf?index=trueIn PDF document text
  • https://45ed8376-e832-497f-ab20-0a31924dc5db.filesusr.com/ugd/4b7290_8a94513912f642419b88e7cebcdf9abd.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/lebaxa/goxofupimadupabokubilik.pdfIn PDF document text
  • https://s3.amazonaws.com/firigugixujotov/how_to_remove_samsung_tv_stand_lcd.pdfIn PDF document text
  • https://486bfeb6-87d8-40a3-812f-3449909c9139.filesusr.com/ugd/81b904_64d8d6098bf44832871abf0b747328f3.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/kuxuxemu/inches_to_centimeters_conversion_table.pdfIn PDF document text
  • https://s3.amazonaws.com/jajoxulabojaso/inverse_and_composite_functions_worksheet.pdfIn PDF document text
  • https://86a6be6f-1c3f-48a2-98e5-8a654ddc1212.filesusr.com/ugd/027f51_b22bd0f9ceef489ca6bfbb457862faca.pdf?index=trueIn PDF document text
  • https://c01188fd-d8af-4b86-846b-090f7ecd58d8.filesusr.com/ugd/9058e5_b2922319724f41b79aaa6c6a765a062d.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/tuxalowafokuvo/examples_of_critical_thinking_questions_for_college_students.pdfIn PDF document text
  • https://s3.amazonaws.com/vuraradaso/97147023339.pdfIn PDF document text
  • https://s3.amazonaws.com/mafavuzenoliki/nursery_rhymes_songs_lyrics_and_chords.pdfIn PDF document text
  • https://s3.amazonaws.com/lekezaru/british_medical_journal_case_report_format.pdfIn PDF document text
  • https://f187853a-68e6-4ed6-a420-9593b89d6738.filesusr.com/ugd/27c34a_ea3f89f0565a426a8dd67cfe83699253.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/gonasidupij/68891982022.pdfIn PDF document text
  • https://s3.amazonaws.com/fatikonavori/sato_cl4nx_driver_mac.pdfIn PDF document text
  • https://s3.amazonaws.com/fevobelijogal/gurisuxovasufuzon.pdfIn PDF document text
  • https://s3.amazonaws.com/mukut/55154337572.pdfIn PDF document text
  • https://b354d503-40d1-4c97-84b4-bc0b16c12f35.filesusr.com/ugd/8c7d07_54f208fd0f2c4833bfe10633ee2ad1fc.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/navoburarovada/71388038435.pdfIn PDF document text
  • https://ce3a146a-d504-4efb-981c-4593fb85d965.filesusr.com/ugd/5b5da7_8b289c0795c342a1b40fc5f29b2bd06b.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.