Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://chcial.ru/pbw?utm_term=how+to+calculate+degree+of+financial+leverage+example PDF link annotation

  • https://fusodozot.weebly.com/uploads/1/3/4/0/134096428/fawosamuzifujiz_ziravas_bomapawiro_futubekit.pdfIn PDF document text
  • https://guvoladedesu.weebly.com/uploads/1/3/1/4/131453897/9080141.pdfIn PDF document text
  • https://vopesowe.weebly.com/uploads/1/3/4/6/134638419/kidomine.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/faa1911a-37d9-4bed-b032-fc31e99329bf/rozugasemekegazabom.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8a69065e-dbb4-4d5c-a490-ef47451baf02/duwulalitusareviju.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2c38d5fc-7b0d-4b8a-914e-1c2036714acc/algebra_teoria_de_exponentes_ejercicios_resueltos.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e6a256a3-2550-4179-ad73-57f4e24e144c/14792289247.pdfIn PDF document text
  • http://tufukamapaf.pbworks.com/f/how_to_connect_onn_soundbar_to_samsung_smart_tv.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bc4437d8-3eee-4960-95c8-21a4ccc1ec40/17783050826.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/07cc0b17-99de-4ca6-8dc5-a56c300b6017/94129449908.pdfIn PDF document text
  • http://zufogopojut.pbworks.com/w/file/fetch/144487890/zane_and_the_hurricane_chapter_1_summary.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/532bbc10-e4ad-469e-a057-8e3f3092195c/candide_de_voltaire_thmes_principaux.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5bd9dde6-63b2-47e8-8b1b-9112787783cf/firuk.pdfIn PDF document text
  • http://zewalar.pbworks.com/w/file/fetch/144463911/71883357366.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b9012288-3473-4fd4-b59c-363052aa4b7c/crosley_radio_director_cd_recorder.pdfIn PDF document text
  • http://kivotin.pbworks.com/w/file/fetch/144678096/healing_plants_book.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3ef22374-c5d0-4aba-a646-dc2094598441/deluzugatijatig.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e9123efb-0790-4737-9271-5806ac5e4b7c/best_old_school_hip_hop_bands.pdfIn PDF document text
  • http://giwupiraride.pbworks.com/f/gta_v_iso_psp_highly_compressed.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f691b103-b1c4-4f77-88db-b021babfb74d/what_is_the_theme_of_the_cask_of_amontillado_commonlit_answers.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0b9af542-b889-4e17-8959-1bb44e46622d/price_of_bitcoin_today_in_usd.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a469b08d-fd2a-49b6-b330-3fe407ea6ec2/meaningful_sentence_on_monstrous.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0b29847e-71c1-4cd6-afdb-7622d1745428/what_determines_perception_of_colour.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e4d52681-c05e-4f79-865c-b3c3f6e7084c/how_to_take_pictures_in_portrait_mode_on_iphone_6s_plus.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/854930a8-2780-4ce7-aeb2-b5f708a5ed3f/27720030187.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a3a3d055-c965-4db8-a6ae-22dc6347f278/elm327_mini_interface_software.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.