Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://fokemale.ru/strik?utm_term=best+roomba+for+hardwood+floors+and+rugs PDF link annotation

  • http://dolinunuridaku.iblogger.org/paweko.pdfIn PDF document text
  • http://nepufikusugepa.iblogger.org/sulasikawel.pdfIn PDF document text
  • http://dokolifaritib.22web.org/tratamento_da_pneumonia_bacteriana.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/jaxesabi/brandy_melville_locations_massachusetts.pdfIn PDF document text
  • https://434dcbc4-7bd9-40fe-99bf-e102daebf961.filesusr.com/ugd/07ef24_5643e3cfa10f47f9956332546665efa5.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/jumedemimo/77781229055.pdfIn PDF document text
  • https://f459ab6e-ac57-43ce-b83a-1524846427e4.filesusr.com/ugd/938c70_cf46b631f839463b9545c3e42e904825.pdf?index=trueIn PDF document text
  • https://29159626-56e2-4eb2-a8c1-eb081f451e44.filesusr.com/ugd/a58502_c09710cb698841e0beba5bf9c2dd94ae.pdf?index=trueIn PDF document text
  • https://f405dec1-7f90-4f4c-a861-5286f67d0127.filesusr.com/ugd/ab922d_43342d9db8104fe986495041ebbf766e.pdf?index=trueIn PDF document text
  • https://77da94c0-0f0a-445b-87af-e489a0b5ef66.filesusr.com/ugd/db1da1_fc379ba0a8b04c039e458a8268e44e4b.pdf?index=trueIn PDF document text
  • https://1fa67a36-2e8b-44cc-a955-751d80433762.filesusr.com/ugd/d85e51_c351aafe251049c8b70bde97e5b765fb.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/zexozavo/nukanojurimiwopaxoru.pdfIn PDF document text
  • http://vanepozimor.rf.gd/bittorrent_client_free.pdfIn PDF document text
  • http://jifagul.rf.gd/82074324844.pdfIn PDF document text
  • https://s3.amazonaws.com/xakapudakadu/mark_twain_lake_crappie_fishing_guide.pdfIn PDF document text
  • https://c039f79f-855f-4b64-8838-30138aeea086.filesusr.com/ugd/6b78cb_7b7e1cc25f694314ba1d44419a03378f.pdf?index=trueIn PDF document text
  • https://ee60c613-3dd1-430d-b711-08e3dcbf0273.filesusr.com/ugd/19ce5d_3724715ee5ac41ffb1a632d10660453e.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/zozuxukoxo/tone_mood_and_author_s_purpose_worksheets.pdfIn PDF document text
  • https://28932ed2-21d9-4123-99cb-fcff0aac4472.filesusr.com/ugd/cc089a_46cad0f411ba44139bab7c50dca571f0.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/fifuto/zininivoduja.pdfIn PDF document text
  • https://4b4ea461-5266-411b-8735-d5290551f550.filesusr.com/ugd/7fedcf_eafbca837fcd4d818dd72d07bda3d4a7.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/ropidadegaxut/26860932146.pdfIn PDF document text
  • https://43a2ba88-5de9-465b-b95f-6a4d82f2d06e.filesusr.com/ugd/dcbeda_50c9b32588cb4f61b6bf0260d53a6f9e.pdf?index=trueIn PDF document text
  • https://694dae7a-2033-4a59-8b06-91ff4eec0774.filesusr.com/ugd/e1d58f_ea306a6941e948118c26d78ee8f1533b.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.