Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Callback phishing phone lure medium SE_CALLBACK_LURE
  Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://soxebez.ru/strik?utm_term=how+do+i+unmute+my+ringer+on+my+vtech+cordless+phone PDF link annotation

  • https://static.s123-cdn-static.com/uploads/4410418/normal_5fcf47c5d053e.pdfIn PDF document text
  • https://sujugixuguxidi.weebly.com/uploads/1/3/4/6/134615921/vigakuwib.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4461505/normal_6046ba76d663c.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4460686/normal_5ffc82fdb9dc7.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4418781/normal_5ff22ab9a6acd.pdfIn PDF document text
  • https://nelizozab.weebly.com/uploads/1/3/0/8/130874358/ragosugonuwig.pdfIn PDF document text
  • https://dotanivim.weebly.com/uploads/1/3/4/7/134705276/5059855.pdfIn PDF document text
  • https://tedibajibivo.weebly.com/uploads/1/3/1/4/131406927/3457679.pdfIn PDF document text
  • https://jetasiduneka.weebly.com/uploads/1/3/4/5/134586997/kokidoga.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4384642/normal_6003d62f69d58.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://bcbc83ff-a82b-4234-bf1d-c69e8cae54d5.filesusr.com/ugd/057c82_d9048399e39a4225a4d01637b2c06cc4.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/752b0dec-cc65-46fc-8eb1-76abd8f2dc26/mududipizorisanedofarut.pdfIn PDF document text
  • http://tukaxowelu.rf.gd/ib_approaches_to_learning.pdfIn PDF document text
  • http://puzasapexuwuju.epizy.com/elder_scrolls_online_bloodroot_forge_guide.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c1550f6a-541d-4c3b-8fd9-7135bb0566fc/epson_artisan_810_price.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3514c173-ef76-4df0-811d-fa11259dcadf/ps3_move_harry_potter_book_of_spells.pdfIn PDF document text
  • http://jekalabol.epizy.com/candide_voltaire_resume.pdfIn PDF document text
  • https://50c84cdf-c8d4-407e-a307-361b94491100.filesusr.com/ugd/f2656e_439d1653db294df98c8f0083d69064ed.pdf?index=trueIn PDF document text
  • https://c8f6a2ed-bc8a-4fd4-b26a-19707db7c4cd.filesusr.com/ugd/1cc7e8_9bdd8f1d73f14601a08663b382415473.pdf?index=trueIn PDF document text
  • https://ca30e0e0-ecf2-44ab-b6a2-fe26291458be.filesusr.com/ugd/34e21e_5c36e78d2a3843fa9fec1c0d2191799b.pdf?index=trueIn PDF document text
  • https://d78d2789-9aef-4bfd-88be-9093bec910ef.filesusr.com/ugd/87a178_4e38adae85d54508916067eb68d7174f.pdf?index=trueIn PDF document text
  • http://kazowaz.rf.gd/xuludopumajafadowuxom.pdfIn PDF document text
  • http://gevasonajudot.epizy.com/how_to_use_my_casio_fx-9750gii.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fe5f4a0f-89f8-401a-9c83-ba414ecd70f5/yard_machine_riding_mower_repair_shops_near_me.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.