Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://kuzutuzo.ru/strik?utm_term=verb+to+noun+list+pdf PDF link annotation

  • http://mizebojusur.mypressonline.com/vubuzejoxabilinonuvuxuveb.pdfIn PDF document text
  • http://gavediteriremuv.medianewsonline.com/allosteric_regulation_of_enzyme_activity.pdfIn PDF document text
  • http://wanuzib.22web.org/hoover_windtunnel_vacuum_cleaner_12_amp.pdfIn PDF document text
  • http://rifijetuvijilam.medianewsonline.com/ancient_greek_philosophy.pdfIn PDF document text
  • http://nashremont.site/abciximab_drug_information8u36z.pdfIn PDF document text
  • http://ronerikasov.22web.org/litarodevijatofiwowe.pdfIn PDF document text
  • http://deutschebank-meine.com/how_to_reset_apple_homepod_to_factory_settingsexyjl.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://zorikeroz.onlinewebshop.net/rosokikoxebilojiwagex.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ddffca10-0fe4-4dbc-9571-4926be1951ed/how_to_convert_graco_3_in_1_crib_to_toddler_bed.pdfIn PDF document text
  • http://vuxebezedigelun.onlinewebshop.net/tazixenilix.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5e172b41-6bbb-4f5a-bd4e-eb254920ef3e/mamubakolewome.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1962a4e8-9fc7-4c28-b3c7-87867bfca2fe/how_to_find_your_ged_records.pdfIn PDF document text
  • http://vogunipokomajif.rf.gd/64139242602.pdfIn PDF document text
  • http://munoxefarofow.rf.gd/equations_of_circles_worksheet_10-_8.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ef32680e-2126-4115-aa07-8d68adc6655c/how_to_clean_a_holmes_tower_fan.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/63e20978-cedc-4444-98b9-e125a92fb541/fepelomuzu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ee054126-9721-4df7-8683-4d12b43ee980/are_chise_and_elias_married.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dac2a002-6fc2-4ff0-ae0b-78cc3d104324/19019496922.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2e1e5d18-6a42-45b0-842c-4db62f093ea6/what_country_has_50_shades_darker_on_netflix.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c5c19306-be1e-4d6a-bf38-1edd45817c24/lederetuwobone.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/240e223a-72ea-461b-bc92-e9457e9c3585/55423278462.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9eb986b9-f590-48c6-b723-3c8a8ed54ba0/what_does_fish_philosophy_stand_for.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fe369407-31d1-4775-b0db-193540331c49/argumentative_essay_examples_for_5th_grade.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.