Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://allytemp.ru/pbw?utm_term=nba+live+mobile+unlimited+coins+and+cash PDF link annotation

  • https://gegosaso.weebly.com/uploads/1/3/4/0/134040985/xewiginaxoxuma.pdfIn PDF document text
  • https://didubovo.weebly.com/uploads/1/3/7/5/137512530/4cd51dd.pdfIn PDF document text
  • https://zufuzizulilok.weebly.com/uploads/1/3/4/7/134702460/8886297adc8f19e.pdfIn PDF document text
  • https://juloxiwam.weebly.com/uploads/1/3/5/9/135967800/4737175.pdfIn PDF document text
  • https://tejekukukageza.weebly.com/uploads/1/3/4/6/134662245/28c59ca6cd0bdf.pdfIn PDF document text
  • https://furadigiwib.weebly.com/uploads/1/3/1/4/131407367/durabi-tapun-jetujafupa.pdfIn PDF document text
  • https://dobopekajami.weebly.com/uploads/1/3/4/3/134314215/5700632.pdfIn PDF document text
  • https://rokubupudila.weebly.com/uploads/1/3/1/8/131856034/napiv.pdfIn PDF document text
  • https://wavenugila.weebly.com/uploads/1/3/4/8/134852162/benolosapeberis-burin-nujarewiralix.pdfIn PDF document text
  • https://baziwiruxufuwav.weebly.com/uploads/1/3/1/4/131482892/4bed4ec23112.pdfIn PDF document text
  • https://mebusogaduvorit.weebly.com/uploads/1/3/0/9/130969439/1376872.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/cce87849-d915-42ab-93e5-c20f4bb71a00/wezefamuwafutobutajelekav.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/22bb5a4a-774f-4de8-a31e-ebddcddf946f/44243420469.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1d7a95f4-d7e5-48c2-953d-00a236020214/adding_fractions_with_unlike_denominators_practice_9-5_answers.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/473fda8c-79c1-43f8-add0-e46ca893be44/woridixurotijusosekubezi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b9bba7ec-513e-4ffb-bbc8-dd3ea5dc233c/traditional_vs._modern_teaching_methods_advantages_and_disadvantages_of_each.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/147df819-433d-4525-bb75-fcb54edfae09/why_is_my_honeywell_thermostat_not_turning_on_heat.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/16b40683-1bcf-4057-9634-d998ed183d36/19222779118.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b901c3b4-3f36-44f6-b8f5-e5ab67881a30/64114920672.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7a87f27a-3994-448d-b672-09a7c10d183b/hp_envy_4500_not_accepting_ink_cartridge.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e0dde185-f926-4541-a0e2-0015061c4fd0/43050319239.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e2677415-0120-4003-8fbe-6337881cb83d/kazesuxena.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.