Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://botokaw.ru/strik?utm_term=what+does+emphatic+mean+in+english PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4366952/normal_5fd182246dd3c.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4365539/normal_60339d45a8f21.pdfIn PDF document text
  • https://pumaxodevuk.weebly.com/uploads/1/3/1/8/131872084/viwusovigijoma_jegukukezipi.pdfIn PDF document text
  • https://fivefijoxiwu.weebly.com/uploads/1/3/1/4/131453543/makuduj_pabuj_jakowovimagi_nomekar.pdfIn PDF document text
  • https://bojotipawotos.weebly.com/uploads/1/3/2/6/132681617/194914.pdfIn PDF document text
  • https://demujerifusa.weebly.com/uploads/1/3/1/4/131437649/1227c.pdfIn PDF document text
  • https://xasevezivim.weebly.com/uploads/1/3/5/3/135302984/82be5d3520c1b6.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/f89b79e0-26fa-42a4-b9f8-661c6a0103b8/amana_front_load_washer_not_working.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1786cd08-b691-4193-acef-666c03aa0ab8/bbmas_2019_full_show.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7c4350d6-279c-4196-8a3e-0f964b89d3c8/gestational_diabetes_blood_sugar_levels_chart_australia.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1b78a668-703a-45cd-9e96-7704c6a82c73/50625307580.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/880d890e-5f47-4526-a8ad-0fcfee65df45/how_to_install_bodyslide_skyrim_se.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8fea0a89-ddff-40f8-8eca-b6291487b167/murumanutuluzam.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9ee93f53-e132-4cfb-b315-d2bc0eaa3f61/zemivuxarepima.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/be05174b-3b90-472a-9039-504e5d4e598f/software_project_management_certification.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/90660e56-8276-4950-b14b-532f88f2e477/diferentes_tipos_de_ficha_de_leitura_existem.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8ba6f967-7c0c-4ff5-a282-c0a38d882247/what_is_the_theme_of_the_book_night_circus.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ca8b29a3-4413-47c2-b9ef-0c75f00b7c2b/37242885411.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/09cd8cb1-662a-4f82-bccc-3aa98440b0f7/download_game_flat_zombies_defense__cleanup_mod_apk.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6db4e947-e329-4092-bdff-72ed3cce76be/personality_test_based_on_colors.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.