Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Callback phishing phone lure medium SE_CALLBACK_LURE
  Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dafemum.ru/strik?utm_term=interactive+voice+response+%2528ivr%2529+tpin+number In PDF document text

  • http://safagiko.iblogger.org/unreported_domestic_abuse_statistics_uk.pdfIn PDF document text
  • http://podarokinsta24.online/reached_by_ally_condie_audiobookqvlb4.pdfIn PDF document text
  • https://kageketiwef.weebly.com/uploads/1/3/4/5/134581137/a87a29cc0.pdfIn PDF document text
  • http://nasty666.space/canada_food_guide_servings_milkratjs.pdfIn PDF document text
  • https://sejirefado.weebly.com/uploads/1/3/4/6/134682993/kosedamoxetobopese.pdfIn PDF document text
  • http://tevfikyuce.xyz/lojojibisixannooc.pdfIn PDF document text
  • https://dojifidixiwaji.weebly.com/uploads/1/3/4/3/134372722/3d85b068963e.pdfIn PDF document text
  • https://bosewumakujo.weebly.com/uploads/1/3/6/0/136036310/44b51cf.pdfIn PDF document text
  • http://grampus-shop.com/how_do_i_connect_my_hp_deskjet_2622_to_a_new_wifizn2df.pdfIn PDF document text
  • http://verification-help.business/43234097850ri44t.pdfIn PDF document text
  • http://sokojutefame.iblogger.org/samsung_company_overview.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://lefarobi.rf.gd/chaska_red_ferrari_ka_video_song.pdfIn PDF document text
  • https://0dea665b-aaaa-42f3-a52c-f86f0fd1efa2.filesusr.com/ugd/8b9728_09c7d3f995e9410db584e3fd15145fa8.pdf?index=trueIn PDF document text
  • https://769966b8-4adc-437e-bba8-f198cf6e171b.filesusr.com/ugd/41a0b6_2399564f81ff4a268d436d665452eb51.pdf?index=trueIn PDF document text
  • https://c941d99d-b58b-4215-81ce-525e38db2b81.filesusr.com/ugd/2dc4cf_abf41110954a45f68330ad3b31629ab0.pdf?index=trueIn PDF document text
  • https://e7f45dcf-1957-410e-85b1-216e85a225c4.filesusr.com/ugd/a2c2bc_a050f7845ece4bb8898114295482f27f.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/8d783305-fe98-4053-891a-959a0363e7a8/83731652195.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/aa4eb8dd-b6f4-400f-bd71-3f9721386954/do_new_gas_stoves_have_pilot_lights.pdfIn PDF document text
  • https://4647adb0-9c01-46a1-aef1-4380d5873f13.filesusr.com/ugd/edb4a7_2d1b1305131340e3adbf580f8b2d6068.pdf?index=trueIn PDF document text
  • http://wokanulobasanek.epizy.com/sat_test_dates_charleston_sc.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0f3be3d2-7dd9-4a07-b877-5a4698358519/can_i_watch_news_of_the_world_on_netflix.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d9b3168a-1278-4eff-bcf1-97b326816186/xeledemefowefesisunida.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.