Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Callback phishing phone lure medium SE_CALLBACK_LURE
  Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://leonvi.ru/award?keyword=renal+tubular+acidosis+pdf PDF link annotation

  • http://smartcreditus.info/cinemaholic_malayalam_moviewpfon.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4461219/normal_5ff3278b90d41.pdfIn PDF document text
  • https://cdn.sqhk.co/wenavuso/jehajjZ/anaconda_python_windows_7.pdfIn PDF document text
  • http://midunetojonawiw.mywebcommunity.org/22956811237.pdfIn PDF document text
  • http://giftcard-sale.store/58434640965jjk5n.pdfIn PDF document text
  • http://homebig.space/city_of_houston_tickets_and_warrants8m5xq.pdfIn PDF document text
  • https://cdn.sqhk.co/sewadokoka/gs8aBXb/3388625094.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4413707/normal_602160e82dc0f.pdfIn PDF document text
  • http://copyrightsupporthelpcenter.com/796257992902kau4.pdfIn PDF document text
  • https://cdn.sqhk.co/pajijolabalu/JKtLgiN/2010932305.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4476569/normal_6028f52db146f.pdfIn PDF document text
  • https://cdn.sqhk.co/kataregulu/hagd8he/new_york_times_subscription_canada_delivery.pdfIn PDF document text
  • https://cdn.sqhk.co/zifalulog/tiaRGji/free_get_app_iphone_music.pdfIn PDF document text
  • http://lodomujimujug.mywebcommunity.org/how_to_arrange_pages_in_file_online.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4366364/normal_5ff0edad2a9bc.pdfIn PDF document text
  • http://detonic-ufficiale.website/56581508550mttuk.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://7f1888b6-cdab-4603-9914-1cf81a8b29aa.filesusr.com/ugd/6846fe_56bf611c37854f6796acf81b46e7cf77.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/0d71db21-36e0-433a-8e2e-ed96cbd63a99/how_much_do_arizona_foster_parents_make.pdfIn PDF document text
  • http://bilisedutave.myartsonline.com/xuwimexa.pdfIn PDF document text
  • http://zatuvejamubolo.atwebpages.com/what_is_the_best_ccrn_review_book.pdfIn PDF document text
  • https://7605d98d-8b17-4a41-9383-f5c8d5af9bcc.filesusr.com/ugd/2bed4c_85191280a6894328bf2bc380becd2ce8.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/cf01719b-3969-476e-b910-38d3cebc5617/directv_rc66_remote_codes.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5ef64ccf-4eae-4f9a-b7a3-f1485e272ea7/vijomubomubev.pdfIn PDF document text
  • http://sudexixurijaxoz.atwebpages.com/pixar_storytelling_rules_for_effective_storytelling.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/201c2441-8179-466a-abe8-fbe7b882bdf3/adding_and_subtracting_integers_word_problems_worksheet_answers.pdfIn PDF document text
  • https://238a82c5-85a8-4641-a991-2f0f5270ddc4.filesusr.com/ugd/63f22d_a9e6e0c9ffb843dd90910d1f206eef2f.pdf?index=trueIn PDF document text
  • https://63c031ef-a76e-4574-b6c7-b683c5cdde0f.filesusr.com/ugd/3a5e7a_1ac126205d3842ef88120f999d5d56ab.pdf?index=trueIn PDF document text
  • https://07d68bf2-0661-47e2-9ffe-eae068a071af.filesusr.com/ugd/fef806_4809c3481c194d5f8dd293eead35f784.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.