Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://philabc.ru/pbw?utm_term=apple+emoji+in+android PDF link annotation

  • https://jonukejunuxesa.weebly.com/uploads/1/3/1/4/131409236/3823d25276.pdfIn PDF document text
  • https://ninofupefuf.weebly.com/uploads/1/3/1/8/131856131/7991aab5b6.pdfIn PDF document text
  • https://static.s123-cdn-static-d.com/uploads/4448121/normal_60affe00cbaf8.pdfIn PDF document text
  • https://bikujezojodu.weebly.com/uploads/1/3/4/5/134587809/zemilunakojex.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4449766/normal_600270c62d399.pdfIn PDF document text
  • https://juwarojolajekol.weebly.com/uploads/1/3/4/1/134108785/5781518.pdfIn PDF document text
  • https://xuxizubewida.weebly.com/uploads/1/3/4/5/134505251/divuzipatob.pdfIn PDF document text
  • https://lexaxaverewazud.weebly.com/uploads/1/3/1/3/131381910/wexevijevojo.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4455194/normal_602d79a89afe4.pdfIn PDF document text
  • https://jugozikinis.weebly.com/uploads/1/3/4/3/134309765/sonozo.pdfIn PDF document text
  • https://naxozafo.weebly.com/uploads/1/3/1/4/131483391/559b9.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/4b97024b-b594-49d8-a53c-fe80cb9b0dbe/edipo_el_rey_libro_completo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/db1a7f2b-7bee-49f2-9014-00077b0e3b54/lirexos.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/858a4013-5583-48d3-987e-7fd4d6939776/11503635768.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5711017e-d0af-4b3b-8532-33e2585073ed/evenflo_maestro_sport_booster_car_seat.pdfIn PDF document text
  • http://giresizuloki.pbworks.com/f/hum_aapke_hain_koun_full_movie_free_download_for_mobile.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/06ef5464-148b-45bc-9b92-f8b0ca247f9e/how_to_assemble_dutailier_glider.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ad7c4552-8109-4995-abb6-f0f380a472f3/can_i_use_any_micro_sd_card_for_ps_vita.pdfIn PDF document text
  • http://zekapotog.pbworks.com/f/94204438816.pdfIn PDF document text
  • http://wuxikadafi.pbworks.com/w/file/fetch/144562080/46204837320.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d5945537-ddbd-4e51-9e6c-55baf20063eb/spas_around_excelsior_springs_mo.pdfIn PDF document text
  • http://jilawuxifi.pbworks.com/w/file/fetch/144640137/nusikubuxelokemixaraxejom.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a805b2f1-6be5-43fe-82e8-c6af2b50beb7/45616409009.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7078ffd2-288e-4fca-a921-8a807ea0c8dd/what_instrument_is_used_to_measure_room_temperature.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/daa3f176-e460-4b16-9927-aa16f0618eb2/relavefoseberegin.pdfIn PDF document text
  • http://nuxawakaxaz.pbworks.com/w/file/fetch/144527208/evaluation_sur_la_revolution_francaise_et_lempire_4eme.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.