Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• AcroForm button with action trigger low PDF_ACROFORM_BUTTON
  PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://nomylo.ru/pbw?utm_term=how+to+reset+rt-ac66u PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4417213/normal_6035688d77921.pdfIn PDF document text
  • https://fijomenameti.weebly.com/uploads/1/3/0/8/130874411/6343972.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4474979/normal_5fc7e4fd2cfea.pdfIn PDF document text
  • https://vusesuke.weebly.com/uploads/1/3/4/7/134723580/3486445.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4494657/normal_5fea1d30535ac.pdfIn PDF document text
  • https://vafuxukosa.weebly.com/uploads/1/3/4/4/134440110/8db2e20e15547.pdfIn PDF document text
  • https://pegejajala.weebly.com/uploads/1/3/4/1/134109309/776247.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4465386/normal_60218b813da06.pdfIn PDF document text
  • https://fedubipogumuwu.weebly.com/uploads/1/3/1/3/131379546/4429328.pdfIn PDF document text
  • https://pobanuritixejun.weebly.com/uploads/1/3/4/6/134601578/moselaz.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4414360/normal_60006c3d900a5.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/2844596f-aefa-4485-a35d-61d83fe1c15c/71632025014.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d16138f0-7f44-4d09-9be2-7d89aadb1e42/66791307049.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/145e53d4-b680-4017-ad64-90252b9b41f7/does_usps_deliver_on_a_sunday.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ed802fae-d667-4d8c-b2a5-ed2a5b46c56a/zalipidoradano.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2348326e-cc2e-4c4b-905d-9839076a6e13/73325352014.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/af050979-9868-4c2b-a9a9-ddf7fc66cfd7/908775027.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/32b58e44-027a-4938-a205-727d18e793d3/how_to_remove_battery_from_motorola_phone.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1363faa0-c5cb-460e-a912-91e8b507c78f/jokefadogudaledutad.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/13325ab6-0aaf-4b52-8719-282ca2caadfc/76086118175.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7ce4144b-08cd-43f4-8467-272be5d56c1e/mists_of_avalon_movie_where_to_watch.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c1cbe1c1-b960-4cb1-afa4-28e756bc465e/irobot_roomba_860_battery.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/567df0e3-99c1-4a83-a3cc-a92feaf1af9a/yamaha_digital_baby_grand_piano_white_-_clp-565gp.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/86b05253-961c-4571-a23c-4db12eda8313/biomes_of_india_ppt.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.