Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://vilenefex.ru/123?utm_term=verk%25C3%25BCrzte+strukturformel+alkanale PDF link annotation

  • http://workmonster.net/tamawebijobujibajavedujap038tw.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4445125/normal_603ac543ad3c4.pdfIn PDF document text
  • https://cdn.sqhk.co/vunalogivefu/0jcqhbs/worth_it_dance_choreography.pdfIn PDF document text
  • http://mivetys.xyz/bedingte_formatierung_excel_5_farbenhvs9e.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4493195/normal_5fd6d0a13677c.pdfIn PDF document text
  • https://kevewejisarugi.weebly.com/uploads/1/3/4/6/134611403/pozanifobarugagov.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4478961/normal_6054bbf86cdde.pdfIn PDF document text
  • https://navubuxodogonid.weebly.com/uploads/1/3/5/3/135327143/femeveme_winiti.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4494893/normal_6054f56237d73.pdfIn PDF document text
  • https://lefesime.weebly.com/uploads/1/3/4/8/134882546/lutufogel.pdfIn PDF document text
  • https://dopakujovifoba.weebly.com/uploads/1/3/0/7/130739833/8350566.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4480145/normal_603db1c346f10.pdfIn PDF document text
  • http://copyright-services-us.com/dibujos_de_caras_tristes_para_colorearivfei.pdfIn PDF document text
  • http://cmbespaceclient.xyz/trailer_park._boys_season_15_release_date5uuuc.pdfIn PDF document text
  • https://cdn.sqhk.co/melipetoluf/jFjgjjF/foguta.pdfIn PDF document text
  • https://cdn.sqhk.co/puxolika/igi3ETf/virgin_mobile_ksa_balance_check_number.pdfIn PDF document text
  • https://cdn.sqhk.co/vakolitakap/ichfkTP/fall_guys_ultimate_knockout_server_timeout.pdfIn PDF document text
  • https://cdn.sqhk.co/bipozipo/jfGHTFv/anime_wallpaper_4k_live.pdfIn PDF document text
  • http://zoomita.fun/78126985910t4d2k.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/293a7cc9-5838-4347-8260-1011ab1ae221/fairy_tail_season_2_anime_planet.pdfIn PDF document text
  • https://c3a7a64c-5591-430b-94d7-c2eadfdf3523.filesusr.com/ugd/966478_957ecf61f44f4b398283e8cbd2da8703.pdf?index=trueIn PDF document text
  • https://af0fe010-594a-4ec7-a26b-e2d78e33490d.filesusr.com/ugd/7d2910_4dd094d8b78e4a7eb4f41b4981082ffe.pdf?index=trueIn PDF document text
  • https://d99c26cc-8c68-456d-a039-1a26994c8d26.filesusr.com/ugd/105a8c_9671ca7aa9184aacb4f2396425b49598.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/bd3ce708-65ec-4450-8406-53b468b3db8c/46121036185.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/442da5e3-c2b9-4bc4-8d65-49be56584c1f/betikuk.pdfIn PDF document text
  • https://92e0cadd-ca3c-497d-ba7d-1aece6ee6da0.filesusr.com/ugd/008e52_98f5695fbf8c454493e7d8a38c9869c7.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/f2b6f8d9-f3cd-40f7-b695-e14b73881106/top_20_romance_novels_2020.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.