Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Urgency / deadline lure low SE_URGENCY_LURE
  Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://leonvi.ru/123?utm_term=bornes+phoenix+contact+pdf PDF link annotation

  • http://health2health.online/77862888379vgmsg.pdfIn PDF document text
  • http://pixell.store/char-broil_tru-infrared_patio_bistro_240_electric_grill_review7jshx.pdfIn PDF document text
  • http://kinoxca.xyz/what_are_the_four_major_periods_of_ancient_greek_history2h0bm.pdfIn PDF document text
  • https://lubozukutiximik.weebly.com/uploads/1/3/4/4/134472848/polumupunuxomezanomu.pdfIn PDF document text
  • http://vivubowi.getenjoyment.net/tempstar_ac_reviews.pdfIn PDF document text
  • http://hayatevesigar.online/fojivipudisevigokexuniprv9ti.pdfIn PDF document text
  • http://fefiwizam.sportsontheweb.net/breaking_night_summary.pdfIn PDF document text
  • http://copyrightshelpcenter.com/john_deere_950_tractory3dgc.pdfIn PDF document text
  • http://gifinibufenatar.medianewsonline.com/adverse_drug_reaction.pdfIn PDF document text
  • https://veraroligesabo.weebly.com/uploads/1/3/4/3/134377370/daxedisupusa-malirixegimax-ladesomox-pejitelenipeto.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/b1f8d24b-0e5c-46a8-af4f-a50815b20357/singer_sewing_machine_model_2662_parts.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/da11953d-9153-4dd6-ada8-6f9470eade74/data_warehouse_francais.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f72b8a9d-4e36-4857-bdd4-be773f566ac2/mubexerosopebun.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/039dd84c-0513-4f81-90f7-bcdc45104419/libro_azul_corolla_2015.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b3191ac1-f711-4b1a-99d1-c4c416c7771e/34120044955.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9e87f8af-8ae3-424b-86a1-2daf0b832072/how_to_adjust_draw_weight_on_bear_apprentice_2.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/aa1095db-c863-4310-87f4-c324ca26b55b/homelite_2700_psi_pressure_washer_honda_engine.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/11d2f031-b49d-477b-bb37-c63634414cbe/raduxovukijepazosi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a1488e6b-70df-4397-ab33-50d4c583bb67/brother_hl-2170w_reset_network_settings.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/aaea13ea-b246-4729-ae09-c1d644313770/why_is_knowing_yourself_important_in_grade_12.pdfIn PDF document text
  • http://pekafujojef.onlinewebshop.net/10731754675.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/96f9d4f9-34dc-48f9-b87e-0d95ad59364e/1079822674.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/789b50b3-ec0b-40c3-9cc2-611c5feb520c/jojebese.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6a7ab757-5c08-4e5f-9b6d-25a2d46eb58a/dutevilomufifunevilip.pdfIn PDF document text
  • http://kavibajegis.onlinewebshop.net/bodyweight_workout_app.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e3a91cf1-fa88-4786-bda9-fe2b87926aeb/68357535216.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.