Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://xajibur.ru/award?keyword=precalculus+textbook+pdf+download PDF link annotation

  • http://vigastlens.xyz/8562447637000lpm.pdfIn PDF document text
  • http://pipvip.ru/nylon_6_12_safety_data_sheetw3ti0.pdfIn PDF document text
  • http://damomemisogadex.iblogger.org/80554766026.pdfIn PDF document text
  • http://miiliioner.xyz/kitchenaid_refrigerator_repair_san_diegoqyi2q.pdfIn PDF document text
  • http://fitit.space/bingo_game_template_printablesbwkd.pdfIn PDF document text
  • http://kenugizi.getenjoyment.net/94422728610.pdfIn PDF document text
  • http://kepuxom.mypressonline.com/articles_grammar.pdfIn PDF document text
  • http://rejorevubirobu.sportsontheweb.net/ace_english_book_adda247_download.pdfIn PDF document text
  • http://kilekapalovuzo.getenjoyment.net/bundesliga_2020_18_spielplan.pdfIn PDF document text
  • http://dom-bita.org/2004_chrysler_pacifica_battery_drainyw0hz.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://zikomum.epizy.com/appsc_group_2_syllabus_2020_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1da1765e-1512-488d-88f8-556ac38d8fd4/varuvagesidu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9cf6ab4e-d32b-45b8-961a-648b21f10cd1/bagazobopepirizig.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/55352fdc-0a3c-48d5-b37a-f9b3000df83f/96151956070.pdfIn PDF document text
  • https://02408c19-b9f6-4996-a596-1d5b7e46c8d3.filesusr.com/ugd/c83fdb_0c7fd1ce06d54c828b33ab9d36fcf5ed.pdf?index=trueIn PDF document text
  • https://4ac36a2f-1533-488b-b282-cf34cdace458.filesusr.com/ugd/bcfc12_78fdbe16a2e245c2ad552fd776de6cb3.pdf?index=trueIn PDF document text
  • http://peledopa.myartsonline.com/autodwg_to_dwg_converter_registration_code_free.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7eaec78c-0854-48e7-84de-2839210d12cd/what_is_the_best_light_therapy_mask_on_the_market.pdfIn PDF document text
  • http://dekifovep.epizy.com/60988526839.pdfIn PDF document text
  • http://viromumixemet.rf.gd/xewedanilitasamududebagof.pdfIn PDF document text
  • http://xiwexuxe.atwebpages.com/punjab_national_bank_education_loan_application_form.pdfIn PDF document text
  • http://vavadot.onlinewebshop.net/architecture_building_design_process.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ff88be9d-4923-40fa-b932-a99e67c4a631/romeo_juliet_quotes_baz_luhrmann.pdfIn PDF document text
  • https://f499a9ea-5579-4d3c-a180-ba191067f9b7.filesusr.com/ugd/34ec99_e189aff0d1c840d1a3b4b7c5e707b82e.pdf?index=trueIn PDF document text
  • https://6d0c6d30-55b9-4b7f-8145-34d11b484ddf.filesusr.com/ugd/8db56d_120b18f4604049d1b1a0dcac9e587be5.pdf?index=trueIn PDF document text
  • http://duziroro.myartsonline.com/celestine_prophecy_book.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.