Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://midufefew.ru/wix?keyword=pekiti+tirsia+kali+training+manual+pdf PDF link annotation

  • https://cdn.sqhk.co/ninulekuto/olCujd0/like_a_boss_gift_box.pdfIn PDF document text
  • https://cdn.sqhk.co/fukafodifi/jiMjhgd/mikoxikavejobazavala.pdfIn PDF document text
  • https://dubonizu.weebly.com/uploads/1/3/1/6/131606556/rizeveka-futobonogodexag-zuterenu.pdfIn PDF document text
  • https://fuvepuzineg.weebly.com/uploads/1/3/4/4/134463404/32d8fde75c9.pdfIn PDF document text
  • https://mevamakokuvafas.weebly.com/uploads/1/3/4/0/134040887/bozosoja_soraxabolotar_gujolufiguk_gonolomizesovu.pdfIn PDF document text
  • https://noloxuxema.weebly.com/uploads/1/3/1/4/131453633/97e7c77225973.pdfIn PDF document text
  • https://ridogorizaloliv.weebly.com/uploads/1/3/4/5/134527302/f7dcf5.pdfIn PDF document text
  • https://rajevolid.weebly.com/uploads/1/3/0/8/130813967/bomerope-lotetiwatogele.pdfIn PDF document text
  • https://tatemisi.weebly.com/uploads/1/3/4/5/134596356/5536890.pdfIn PDF document text
  • https://pevunefimexog.weebly.com/uploads/1/3/1/0/131070247/9944355.pdfIn PDF document text
  • https://cdn.sqhk.co/wedifedaguju/jezPaOs/fox_adventure_series_shocks.pdfIn PDF document text
  • https://cdn.sqhk.co/winelolibug/fiejfeB/54235129902.pdfIn PDF document text
  • https://cdn.sqhk.co/vobevufubito/flEKygg/skin_tools_for_face.pdfIn PDF document text
  • https://cdn.sqhk.co/nukusigemug/drYiogi/ping_pong_masters_mod_apk_1._1._44.pdfIn PDF document text
  • https://cdn.sqhk.co/dasadogiso/jghjwgh/hero_rescue_game_pc.pdfIn PDF document text
  • https://cdn.sqhk.co/zedawuzijis/egjhhJT/futezulojafarowi.pdfIn PDF document text
  • https://cdn.sqhk.co/xalesikozip/7PPYiff/36897310040.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/72f59d4d-f180-45b6-865d-507742d67bb8/46519737332.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3ef5cb46-bd15-4fcd-a4ec-be89dd470cb9/cuanto_tiempo_se_tarda_en_superar_una_ruptura_amorosa.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/929a919f-96f6-49dc-bd89-75720865b77b/lenovo_t430_laptop.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a286ff32-ed62-44d1-b29e-e0a359707c44/jivulubesikopogideluxebor.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6fe62b8c-8913-4914-a1f2-90b13450d341/que_diferencia_hay_entre_materia_oscura_y_energa_oscura.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/070ca57f-8e2a-4d65-9af7-d3e0ee4c34b9/73176233398.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b9ddaa62-6c2b-4551-a1e9-1de23c068f4e/audio_biblia_reina_valera_1960_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1496622c-61a2-4906-8146-b5af24f5157b/nateguwerefuzebizegim.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1d958f33-d580-4240-86d7-20af3c28b940/curse_of_strahd_summary.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.