Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
  Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://nipisod.ru/strik?utm_term=how+do+i+enable+the+command+key+on+a+mac PDF link annotation

  • http://xojuxelase.medianewsonline.com/why_does_my_kitchen_faucet_leak_at_the_base.pdfIn PDF document text
  • http://bagomebefekixob.getenjoyment.net/where_would_you_go_bernadette_cast.pdfIn PDF document text
  • http://zomosidotewe.sportsontheweb.net/pardoner_s_tale_summary.pdfIn PDF document text
  • http://manuximaxemeje.scienceontheweb.net/baby_bjorn_carrier_instructions_front_facing.pdfIn PDF document text
  • http://jojazinex.mygamesonline.org/66015075726.pdfIn PDF document text
  • http://russianpatentexpert.com/how_to_tie_a_mens_bow_tieuz70y.pdfIn PDF document text
  • http://discount50it.pro/872751671122nkig.pdfIn PDF document text
  • https://bojuwakuxejekur.weebly.com/uploads/1/3/5/3/135347713/puguvalugajiza.pdfIn PDF document text
  • http://yyyyyyhhhhh.space/bajrang_dal_song_2017_audiomxqvx.pdfIn PDF document text
  • http://magnitoli-2ekran.site/how_to_pair_blue_parrot_450_headsetdci8x.pdfIn PDF document text
  • https://zevigutuxokalu.weebly.com/uploads/1/3/4/7/134769804/felizujazojonopik.pdfIn PDF document text
  • https://dubobovutorikug.weebly.com/uploads/1/3/5/3/135332124/sanukenusutuxaxu.pdfIn PDF document text
  • http://javefuxola.getenjoyment.net/45314648052.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/vifusupegiza/asp.net_mvc_dropdownlistfor_selected_value_not_working.pdfIn PDF document text
  • http://lobopekogolo.onlinewebshop.net/d-link_dir-890l_ac3200_router.pdfIn PDF document text
  • http://baxewape.myartsonline.com/cephalgia_kronik.pdfIn PDF document text
  • https://6632aaff-1fe9-4f1d-acb3-7d444e457837.filesusr.com/ugd/ce4b7c_cb42fd939cc14f4fb7296667515196f9.pdf?index=trueIn PDF document text
  • http://sidepojedava.myartsonline.com/illinois_safe_haven_law_age_limit.pdfIn PDF document text
  • https://3f054cde-0430-4828-89d0-5f77035cf230.filesusr.com/ugd/d93890_a3044a5a20994d30a70ac71078ae3672.pdf?index=trueIn PDF document text
  • https://0f0532cb-4478-41f9-91a1-cf277c4732ec.filesusr.com/ugd/8acad3_69293e4f950b4838bf27c4469de0162a.pdf?index=trueIn PDF document text
  • https://c3a7a64c-5591-430b-94d7-c2eadfdf3523.filesusr.com/ugd/966478_ef7052a74156445c823ac0dafcbcf5bf.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/lewuli/2003_ford_focus_se_zetec_engine.pdfIn PDF document text
  • https://s3.amazonaws.com/nisoxow/acknowledgement_form_template_california.pdfIn PDF document text
  • http://wuwedilejom.myartsonline.com/lasko_t48314_performance_48-in._tower_fan_with_remote_control_t48311.pdfIn PDF document text
  • https://2e4d99de-9d37-4ce2-abd5-0bbccafdbe51.filesusr.com/ugd/33a2e4_b588d192326f4aa993523514d0e163f4.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.