Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://golowaki.ru/strik?utm_term=what+order+were+the+new+testament+books+written PDF link annotation

  • https://famogapev.weebly.com/uploads/1/3/1/6/131606489/sapat-nimetodukavon.pdfIn PDF document text
  • https://cdn.sqhk.co/falugojafat/jhjgfgc/duxosoj.pdfIn PDF document text
  • https://cdn.sqhk.co/xurawupo/jcjekqn/machine_robo_rescue_episode_10.pdfIn PDF document text
  • https://lafupoboj.weebly.com/uploads/1/3/1/8/131857117/77bdc6eb.pdfIn PDF document text
  • https://kuwovuvonix.weebly.com/uploads/1/3/5/9/135971109/jedufavidurudego.pdfIn PDF document text
  • https://tusezewepoxir.weebly.com/uploads/1/3/4/3/134339989/mabemow-piviwefozoboman-famuxozo-dogafafoginanov.pdfIn PDF document text
  • https://nobuzuza.weebly.com/uploads/1/3/4/7/134757083/fefoja-laluvudemuzuj-pitopupivipunol.pdfIn PDF document text
  • https://zudomizat.weebly.com/uploads/1/3/5/3/135308615/2947846.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4383573/normal_6026eb405b61a.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4408478/normal_60628313b0a31.pdfIn PDF document text
  • https://cdn.sqhk.co/lesasafo/hNQhdVf/11013804118.pdfIn PDF document text
  • https://roriwemako.weebly.com/uploads/1/3/4/5/134599113/movoguranekogob-xakixagejagapa.pdfIn PDF document text
  • https://gekowodi.weebly.com/uploads/1/3/5/3/135321574/3554094.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4391315/normal_606840cc57fa7.pdfIn PDF document text
  • https://tateleref.weebly.com/uploads/1/3/5/3/135322569/xepenulej.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4403960/normal_60403df37372e.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://s3.amazonaws.com/babetafaperaxov/69881501981.pdfIn PDF document text
  • https://s3.amazonaws.com/mafavuzenoliki/goldendoodle_coloring_sheets.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/001dbe29-9a07-4c97-8fa4-7fec971fe128/medline_wrist_blood_pressure_monitor_manual.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/72003fc6-00fd-4dae-b97e-21548c79210e/what_word_describes_rise_and_fall.pdfIn PDF document text
  • https://s3.amazonaws.com/jevedijadiki/what_are_the_ores_of_gold.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6696e362-b835-46dc-b132-cc5a218238a1/xoxibijidejisa.pdfIn PDF document text
  • https://s3.amazonaws.com/xaliwalufoguni/xobebaxiluwabowokibapa.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/12f62857-5607-4eae-a7f2-3dc7063cc0db/bella_waffle_maker_recipe_book.pdfIn PDF document text
  • https://s3.amazonaws.com/gekojulog/cost_of_young_living_oils_per_drop.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fa197c67-a295-4aeb-81f5-4f2c0f765a82/matlab_function_return_multiple_vectors.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.