Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://medvor.ru/pbw?utm_term=diamond+platnumz+ft+wizkid+rotate PDF link annotation

  • https://static.s123-cdn-static.com/uploads/4426260/normal_5ff6124f441fe.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4482671/normal_5ffba17b5c9f6.pdfIn PDF document text
  • https://farezixinebi.weebly.com/uploads/1/3/4/2/134266061/bumex_mazadinivoranu.pdfIn PDF document text
  • https://dujapiloxi.weebly.com/uploads/1/3/1/8/131857305/sefekasibubaxoz.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4417675/normal_605f324314ec2.pdfIn PDF document text
  • https://mapimodedafibo.weebly.com/uploads/1/3/4/7/134708703/xibajikekemo.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4472495/normal_602984cc949dd.pdfIn PDF document text
  • https://fezapatinegu.weebly.com/uploads/1/3/4/2/134266508/memusagisapubidu.pdfIn PDF document text
  • https://bemetezebore.weebly.com/uploads/1/3/4/8/134882820/lumagipefiraw.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4369631/normal_5fc9bdccb1dfe.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/60c0b654-ebe6-4ea8-891d-53f49f332977/10094660544.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a9c0c8e8-8f30-45a3-bfaf-3c9fbe708585/mapamundi_con_nombres_de_los_paises_en_grande_espaol.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e9de26d9-3045-418f-b096-155d969d6ad5/soxiturelagi.pdfIn PDF document text
  • http://rugewenuzed.pbworks.com/w/file/fetch/144426783/english_grammar_test_paper.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/762543c6-eac9-4e9b-977e-dacb90280ea0/wivepukazirijopune.pdfIn PDF document text
  • http://felefejimax.pbworks.com/f/pixel_gun_3d_fps_shooter__battle_royale_pc.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5636ceb5-75dc-4ea3-8186-39d6798cd599/87150410875.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/35dd2dc2-ecfa-4b18-afac-ef1b882fa367/43395510633.pdfIn PDF document text
  • http://razodegotit.pbworks.com/w/file/fetch/144802836/zijilibatevunaveju.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d85dbff3-c57e-44ae-b6c2-1814bf2db237/learn_python_free_class.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a3c71e77-7f47-4bb0-9286-e0d68f1a719a/what_is_the_legal_system_in_the_us.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1b124ad9-78a0-4abc-9b2f-49e064231c1d/tuesdays_with_morrie_sparknotes.pdfIn PDF document text
  • http://jijagenaneke.pbworks.com/f/26132457636.pdfIn PDF document text
  • http://namikikis.pbworks.com/f/gastritis_diet_chart_in_hindi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ea322521-424a-421d-89fe-77b4b76d44b8/nuzexizefotepegu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a18b3d5e-6a82-4be5-920b-dff6eaa4fdf3/sebaweni.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.