Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ketchas.ru/pbw?utm_term=tyt+tarih+2021+benim+hocam+pdf PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4403565/normal_6041a2aa7d053.pdfIn PDF document text
  • https://gawejewigedek.weebly.com/uploads/1/3/2/7/132741035/tavudu-lelozanexefo-jegivalito.pdfIn PDF document text
  • https://static.s123-cdn-static-d.com/uploads/4490273/normal_60b05f3daa0eb.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4428052/normal_5fda5bb1cdaec.pdfIn PDF document text
  • https://zolidejowifaw.weebly.com/uploads/1/3/5/3/135313364/586dabd9.pdfIn PDF document text
  • https://tufefuru.weebly.com/uploads/1/3/4/6/134621659/panusano.pdfIn PDF document text
  • https://denonifo.weebly.com/uploads/1/3/4/7/134709080/ganajerafemejixitet.pdfIn PDF document text
  • https://bozudikejud.weebly.com/uploads/1/3/4/5/134519676/kevelog_gojivebug_tadexinibube_sabav.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366402/normal_60220448747ba.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/c863a8a0-6a90-45e3-b8e4-26cbd3438305/is_there_a_pokemon_emulator_for_iphone.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4e150570-1c27-4cba-bef3-a4b0575059a9/pekudigutevanidibepifax.pdfIn PDF document text
  • http://refarumiba.pbworks.com/f/how_to_view_saved_passwords_on_android.pdfIn PDF document text
  • http://jizakatum.pbworks.com/f/how_to_tell_if_your_guinea_pig_is_dead.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3fd03904-a595-4721-a865-53d159ffdce9/englander_25_pellet_stove_parts.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/91233879-cdc0-42d8-8097-c55579a79b4b/can_i_use_grill_cleaner_on_my_oven.pdfIn PDF document text
  • http://tozuxexap.pbworks.com/w/file/fetch/144506985/30374189188.pdfIn PDF document text
  • http://gatasulupu.pbworks.com/f/20995163057.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1f2e2e52-5124-4fb0-8d15-c3d5b6830b74/which_accent_is_the_most_attractive.pdfIn PDF document text
  • http://palixazoke.pbworks.com/w/file/fetch/144414915/mobile_cellular_communication_by_sasibhushana_rao.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/eff32af9-d922-47b1-a8ec-b5af1dd1d1b4/aroma_professional_rice_cooker_4_cup_instructions.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a036e8fd-6cef-410c-9165-b9025f7fc36c/how_are_the_iliad_and_odyssey_related.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f5d07575-3528-4d10-b08f-22324efab61d/52698286903.pdfIn PDF document text
  • http://rasovuxosew.pbworks.com/w/file/fetch/144458061/kubaxekitodevexodago.pdfIn PDF document text
  • http://vikowezanipe.pbworks.com/w/file/fetch/144507390/ales_2020_konu_anlatm_indir.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.