Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dafemum.ru/wix?keyword=just+want+to+praise+you+lyrics In PDF document text

  • https://static.s123-cdn-static.com/uploads/4450624/normal_5fcfa63374e58.pdfIn PDF document text
  • http://nunupefaz.iblogger.org/benezoril.pdfIn PDF document text
  • http://tojumuwuluso.iblogger.org/51906066762.pdfIn PDF document text
  • http://mafonofolifeda.22web.org/bittorrent_filehippo_free.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4378153/normal_6006d377e7a45.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4413696/normal_60095f5ee7793.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://59bb578d-b312-442a-858b-1a1a54b18a6c.filesusr.com/ugd/c79b1c_fd85b07df51942f1ae971b9bf10f9128.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/bubeto/desktop_wallpaper_free_for_windows_8.pdfIn PDF document text
  • https://5ec50ee2-6c76-415b-b731-82d7de26534b.filesusr.com/ugd/826e74_f419d386ae4f429e841713d90aaa6f6a.pdf?index=trueIn PDF document text
  • http://dagajevefud.epizy.com/perioperative_antithrombotic_management_guidelines.pdfIn PDF document text
  • https://60659a61-a27b-47ea-8eac-a81775c62269.filesusr.com/ugd/7a7fb1_5f9aa642bb1c48cd9dc57c529cc1d4ad.pdf?index=trueIn PDF document text
  • https://171e2b11-24ea-4535-acac-f971ec821c4b.filesusr.com/ugd/a07927_0fc502afedec4f098e2cda61bd31bb38.pdf?index=trueIn PDF document text
  • http://tepisivud.epizy.com/66225722270.pdfIn PDF document text
  • https://b67fa923-03b4-4d21-b555-95ff628d7525.filesusr.com/ugd/1d4b90_f3b81a04672946c29adb0ed11458e745.pdf?index=trueIn PDF document text
  • https://6648aa49-deb3-4d6f-81a8-a63cc7a297fb.filesusr.com/ugd/38eac1_82f0b9b436ec4c168522503c34b6aeeb.pdf?index=trueIn PDF document text
  • https://df256b98-640c-444d-885a-8195c7360722.filesusr.com/ugd/40b9e6_b6c34f3ed5ad47d499f94f88361897e9.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/tiduro/do_trevor_and_tessa_get_together.pdfIn PDF document text
  • https://78ff948a-0765-49f5-a22c-0fbe0eba7848.filesusr.com/ugd/888d0b_358ebf616aed48058989366e9db9adc8.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/vezumobigodub/driving_school_near_me_manual.pdfIn PDF document text
  • http://roxegubipav.epizy.com/49425496973.pdfIn PDF document text
  • https://36c7e617-1221-4173-b726-d5bce2878801.filesusr.com/ugd/610d21_c3f77082031940238256826f5a25adc0.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.