Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• MFA / one-time-code harvesting lure high SE_MFA_LURE
  Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://baarspo.ru/wix?keyword=afa+niet+results PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4401973/normal_5fd7fa7383872.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4389355/normal_5fc6ca5f602f9.pdfIn PDF document text
  • https://nuguviroguzemek.weebly.com/uploads/1/3/1/0/131070089/rivudapixaxi-ruxali.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4475375/normal_60132dafbb93b.pdfIn PDF document text
  • https://bujajegufo.weebly.com/uploads/1/3/4/1/134108800/fubogojumeratozexan.pdfIn PDF document text
  • https://tokawokemiw.weebly.com/uploads/1/3/4/7/134730305/9972827.pdfIn PDF document text
  • http://wivikaxebox.medianewsonline.com/zajejokefabavadilov.pdfIn PDF document text
  • https://semulojera.weebly.com/uploads/1/3/2/6/132695334/5222b8aeea63aa0.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4385415/normal_600a55570a5c7.pdfIn PDF document text
  • http://dokukuke.mypressonline.com/24113502075.pdfIn PDF document text
  • https://seronenufides.weebly.com/uploads/1/3/1/4/131407086/lubasegek-sugatez.pdfIn PDF document text
  • http://raxejudesezix.scienceontheweb.net/64151093430.pdfIn PDF document text
  • http://zazorin.scienceontheweb.net/what_are_claws_in_birds.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4452837/normal_6044221b150ff.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/sezebepit/climate_change_definition_geography.pdfIn PDF document text
  • https://s3.amazonaws.com/sitozi/4223371163.pdfIn PDF document text
  • https://s3.amazonaws.com/xuxifuzituwu/adverse_information_meaning_in_tamil.pdfIn PDF document text
  • https://cfecb619-c0f5-418d-ae9d-b1147643389f.filesusr.com/ugd/4cd51e_740baecd4ec94ae99f43f01a6afb5e53.pdf?index=trueIn PDF document text
  • https://db6d201d-bdff-4648-9982-d9cfaac7639e.filesusr.com/ugd/98857b_240f5047a90a476cbc4c3bd1a2b36110.pdf?index=trueIn PDF document text
  • https://35e1cc1d-5f6c-4a41-9b1b-b9ae8dddc97a.filesusr.com/ugd/351eee_0a469d8e55d24f528fe9964cca0e8064.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/fizup/40336146240.pdfIn PDF document text
  • https://a121017b-3fb3-450c-9156-48dd71a9bf80.filesusr.com/ugd/07625c_1583cde876b44ddd8c603ea610430971.pdf?index=trueIn PDF document text
  • http://xufoziminep.onlinewebshop.net/speak_now_1_teacher_s_book.pdfIn PDF document text
  • https://19972ee8-34f0-4900-8009-9f590161cd02.filesusr.com/ugd/64db51_1b01fa03e1c44752a4d9172ac24841bb.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.