Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://botokaw.ru/aws?utm_term=how+to+connect+zagg+keyboard+with+ipad PDF link annotation

  • http://expo-kit.ru/what_kind_of_memory_card_does_a_garmin_gps_use7vxbx.pdfIn PDF document text
  • http://copyrightshelpscenters.com/nasal_cavity_bone_structure26pqc.pdfIn PDF document text
  • http://doxedisipi.scienceontheweb.net/george_foreman_grill_cooking_times_boneless_chicken_breast.pdfIn PDF document text
  • http://rankingcoach-apps.com/lux_programmable_thermostat_tx9600ts_manual2l4kq.pdfIn PDF document text
  • http://firstreadersclub.com/worm_cyoa_fanfictioncwzgb.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • http://watotiwima.rf.gd/how_fast_is_the_2020_shelby_gt500.pdfIn PDF document text
  • http://vafegenowakimo.epizy.com/harkins_theater_job_application.pdfIn PDF document text
  • http://gagonunanu.epizy.com/wikix.pdfIn PDF document text
  • https://4d75d3c9-3a4d-4df6-84ab-e48b83d723e5.filesusr.com/ugd/cdb50c_8b6a989f97b3454983a29a5f09ff0681.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/wovedukevikov/lesotho_vs_nigeria_match_report.pdfIn PDF document text
  • http://vawanumezal.onlinewebshop.net/33803317205.pdfIn PDF document text
  • http://luzuviwuk.rf.gd/dell_inspiron_n5010_power_jack_board.pdfIn PDF document text
  • http://fawosafo.epizy.com/medicare_guidelines_for_bone_density_scan.pdfIn PDF document text
  • https://s3.amazonaws.com/gulapore/delumoraxoverorata.pdfIn PDF document text
  • http://lazefip.epizy.com/blue_is_the_warmest_color_full_movie_watch_online_123movies.pdfIn PDF document text
  • https://s3.amazonaws.com/divexikav/dikesegituzod.pdfIn PDF document text
  • http://gametusepezuka.rf.gd/zonevemaripumijarel.pdfIn PDF document text
  • https://s3.amazonaws.com/fuwuzerijofa/naming_aldehydes_worksheet.pdfIn PDF document text
  • https://ba428ff1-d53d-4eb5-bdb2-cc960067f420.filesusr.com/ugd/7041e4_33c25450d3954542ae7d7c6e8d9c96d1.pdf?index=trueIn PDF document text
  • https://a52dd608-e7dd-4d50-8005-e0fd7a3896b4.filesusr.com/ugd/43d2fc_fedf73c763004994b6acbed818dfc0a2.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/welanisowari/fawoxex.pdfIn PDF document text
  • http://votofeki.epizy.com/citizenship_application_guide.pdfIn PDF document text
  • http://rebivik.epizy.com/dabodejejevutizapelokoli.pdfIn PDF document text
  • https://95049c82-e412-4913-a0b0-e03e83d5170a.filesusr.com/ugd/127d6e_2b35fc2d3b0e4d32937590beb4b5e252.pdf?index=trueIn PDF document text
  • https://0ea1ff7f-05b3-43a2-9744-178351a05ed1.filesusr.com/ugd/01f9b9_47c80be4264c48df8da067344df5b76f.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.