Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://crewmak.ru/pbw?utm_term=m3+data+recovery+full+crack+kuyhaa PDF link annotation

  • https://golisarupu.weebly.com/uploads/1/3/5/3/135317681/bowefilak_resim_lafudelituwili.pdfIn PDF document text
  • https://xewulowew.weebly.com/uploads/1/3/4/7/134757629/mesijebibebazuj.pdfIn PDF document text
  • https://jifabipesetumef.weebly.com/uploads/1/3/4/8/134896168/niduzuxukanilol_wisenugevugixuk_senitezaw_fizuxonoxejuje.pdfIn PDF document text
  • https://nirotagikul.weebly.com/uploads/1/3/5/9/135992947/b157526.pdfIn PDF document text
  • https://fadinozejekoxoj.weebly.com/uploads/1/3/4/6/134659303/6306831.pdfIn PDF document text
  • https://vapovudinawixe.weebly.com/uploads/1/3/1/4/131437980/vowotovisipepa.pdfIn PDF document text
  • https://xikalevu.weebly.com/uploads/1/3/4/3/134319979/xavakiwurofo.pdfIn PDF document text
  • https://zesujixiti.weebly.com/uploads/1/3/1/3/131398447/94efcc786582c02.pdfIn PDF document text
  • https://vifurenevu.weebly.com/uploads/1/3/4/8/134890767/4090537.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://jesababa.pbworks.com/f/2246436146.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/078dfeae-0130-4103-adae-117cc3e72775/17531986569.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/de797e24-9651-4e0b-a88b-217b60a84814/of_ships_and_the_sea.pdfIn PDF document text
  • http://mefijunov.pbworks.com/f/40031736624.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/155c8a95-b5f2-41b1-8946-f0f986120e91/char_broil_electric_smoker_cover.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2eca92ec-938a-4900-93c8-98025b8e0d14/convertir_un_archivo_a_word_online_gratis.pdfIn PDF document text
  • http://jajisaparev.pbworks.com/f/duralast_700_amp_portable_battery_jump_starter_manual.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bbf25834-0cbf-4b54-b9f4-42c0c422188b/navy_eval_statement_instruction.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ddafc60b-bc67-497e-8742-75f10c82d567/what_are_the_content_theory_of_motivation.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/143c1465-b9d0-4432-ad6b-c69795407bee/how_to_change_bios_language_from_german_to_english_hp.pdfIn PDF document text
  • http://lekipirunezi.pbworks.com/w/file/fetch/144413619/33539284728.pdfIn PDF document text
  • http://mumasenekera.pbworks.com/f/what_does_the_triangle_symbol_mean_on_dashboard.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a94c492f-0885-417a-8124-8b5c943cff7e/sigma_spectrum_infusion_system_service_manual_p_n_41019v0800.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/71e956a8-cc78-4d05-8e95-c77cddf73f55/muxakekalulogo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2434e23c-2aae-4d9e-af59-0744f4cd38b7/breve_biografa_immanuel_kant.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.