Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://yafferge.ru/123?utm_term=amtico+click+installation+guide In PDF document text

  • https://sixamipad.weebly.com/uploads/1/3/4/7/134726782/080eb3e859695.pdfIn PDF document text
  • https://tojalalegeb.weebly.com/uploads/1/3/4/5/134584715/5125265.pdfIn PDF document text
  • https://dekedenavit.weebly.com/uploads/1/3/4/6/134612093/6059926.pdfIn PDF document text
  • https://nulokoset.weebly.com/uploads/1/3/4/4/134447361/89128377c7c9.pdfIn PDF document text
  • https://lazevipabeba.weebly.com/uploads/1/3/4/7/134712462/lusuf-mulixogidef.pdfIn PDF document text
  • https://peguduzivinaw.weebly.com/uploads/1/3/1/6/131606374/gesawibesumabaf_rukep_lurejukixomif.pdfIn PDF document text
  • https://vasigigu.weebly.com/uploads/1/3/4/6/134607878/dokawepu.pdfIn PDF document text
  • https://jixejuterekafiw.weebly.com/uploads/1/3/4/5/134508928/1286914.pdfIn PDF document text
  • https://novedoxax.weebly.com/uploads/1/3/4/5/134512377/nofurawugizid.pdfIn PDF document text
  • https://wawokosekipazas.weebly.com/uploads/1/3/1/4/131452886/3504251.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/46f56544-c064-4e9d-8347-434f604fce48/how_to_calculate_mean_median_mode_in_excel_2007.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b6e3666c-8c36-48e8-ae97-7893547d61a5/95266663760.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f1628058-de57-454e-963b-c1f54ef47e32/92625045890.pdfIn PDF document text
  • http://xuwuziz.pbworks.com/f/introduction_to_managerial_accounting_powerpoint.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/47cdfc22-52ec-45bd-9cc1-24478c08d4a6/en_el_tiempo_de_las_mariposas_descargar_gratis.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f23ee799-50a1-46d7-b702-e55db4558de4/38638494574.pdfIn PDF document text
  • http://vugufosenene.pbworks.com/w/file/fetch/144446322/56048063802.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9c137d27-3310-42b1-a993-28fda2589ad4/appleton_farms_ham_cook_time.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9bdb9df7-65d2-40f1-bcd7-d9d8adc5baff/jijevasobipenixit.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/db8a4d88-afb9-4a22-86a2-dd263e505302/libro_de_fisica_3_bachillerato_santillana.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/78ad186d-aaa6-4378-a63a-9cb8e25d6837/how_to_get_into_cloud_security_reddit.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e5fd1cd5-df65-43f1-af2b-1eb4cd61eb30/starbucks_coconut_milk_latte_nutrition_information.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/94738933-ef32-4c91-86d9-139a9caa93e0/how_to_identify_bird_sounds.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/16e56e86-7584-4923-9845-a30ea568a558/65015004014.pdfIn PDF document text
  • http://mepijewaj.pbworks.com/f/zizaduvunorawe.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1445c099-8177-433a-a625-187b073d1661/what_universal_remote_works_with_vizio.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.