Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Callback phishing phone lure medium SE_CALLBACK_LURE
  Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://resalured.ru/123?utm_term=due+diligence+report+format+as+per+rbi PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4421474/normal_605bc2a1ae4cd.pdfIn PDF document text
  • https://bowogemiris.weebly.com/uploads/1/3/4/3/134316512/sarokuwamixosun.pdfIn PDF document text
  • https://wasatetokis.weebly.com/uploads/1/3/4/5/134513062/3897915.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4383681/normal_5fd0f51c4a266.pdfIn PDF document text
  • https://sitixibabu.weebly.com/uploads/1/3/4/7/134749551/xegoxi_fulosopujebupos_kagexitasave_wilegidinupefoz.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4489839/normal_6000bc4978596.pdfIn PDF document text
  • https://dajetulanew.weebly.com/uploads/1/3/4/3/134309067/6229152c09d.pdfIn PDF document text
  • https://lunokebu.weebly.com/uploads/1/3/4/6/134648327/7db14a5.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4445104/normal_60286c6facdd1.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/ff67180a-d1e3-4187-b288-73192e68ade8/nowadidabaziwekepaw.pdfIn PDF document text
  • http://zuwofig.pbworks.com/f/vofamedivekijate.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/791de56d-9ee6-47f7-a48f-486da3bfd345/how_to_turn_on_casio_fx-9750gii.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3d793486-a031-4740-86b6-f7cdc022613e/reading_a_metric_ruler_worksheet.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c6f7024b-bfab-494b-8c5e-8b96bbc100b1/juvinirijulijugodomi.pdfIn PDF document text
  • http://dimutojopog.pbworks.com/f/word_problems_dividing_decimals_worksheets_6th_grade.pdfIn PDF document text
  • http://wiwedano.pbworks.com/w/file/fetch/144425382/recep_ivedik_4__35_dakika_full_izle.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4fd1431d-66d6-4227-a4c4-50fefbfba82c/sandwich_book_report_template.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6b014594-9d14-43ae-bdc8-005de40280c8/52463979314.pdfIn PDF document text
  • http://pudamalulera.pbworks.com/w/file/fetch/144548355/secret_language_of_birthdays_november_5.pdfIn PDF document text
  • http://lexibitite.pbworks.com/f/94931798806.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e667c781-6a4b-44f0-89b6-b958fc0f2e5d/25718639369.pdfIn PDF document text
  • http://ronuzexem.pbworks.com/f/sivotogavejefoli.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f16325af-e586-4765-889d-62f2a326584f/99581517305.pdfIn PDF document text
  • http://mikabipi.pbworks.com/w/file/fetch/144431904/msp_starcoins_hack_no_survey.pdfIn PDF document text
  • http://xojifot.pbworks.com/f/clicker_heroes_import_code_editor.pdfIn PDF document text
  • http://nebapelamive.pbworks.com/w/file/fetch/144532104/ver_corazones_y_almas_pelcula_completa_en_espaol_gratis.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.