Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Callback phishing phone lure medium SE_CALLBACK_LURE
  Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://vilenefex.ru/strik?utm_term=milwaukee+18v+charger+wattage PDF link annotation

  • http://sk-anker.ru/ck2_conclave_guideaxr5f.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4499334/normal_6040008f0e882.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4402721/normal_60064b037772e.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4412570/normal_604e1c63524d1.pdfIn PDF document text
  • http://vas-rem.ru/microblanding_que_esnupk1.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4420459/normal_6011b5c3e610b.pdfIn PDF document text
  • http://digitaloffice24.ru/christmas_cake_photosuyc2s.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4423471/normal_5fd069118ad6c.pdfIn PDF document text
  • http://chempion.coffee/267679050211meol.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4447877/normal_5fe2977bad5f3.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://11ca5eb4-0abe-4d5d-8073-3f36f6088e80.filesusr.com/ugd/8b62d8_16ff9ca408cc4092ba7e62550e2667e6.pdf?index=trueIn PDF document text
  • https://000bb656-a8cb-4e8b-9327-0b0ec99f56fe.filesusr.com/ugd/3f812e_d948e396e0cb4693bc59cb6eba46eef2.pdf?index=trueIn PDF document text
  • https://305aa2e3-e1d2-413d-aa2e-f1bb83d03ded.filesusr.com/ugd/92ee2b_4100d6043d0c4272b2c9a8186eeec522.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/ce1f307f-8966-42d3-9900-b368955102c4/wiranipadozusuzorulir.pdfIn PDF document text
  • https://46c19374-600d-43be-a5f2-d8bf07c6fddf.filesusr.com/ugd/cc94a4_3cb19a8307cb4326a185a7b53b76a6d7.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/1ea42fd7-939e-45b1-9988-a53bf24c56e3/stephen_hawking_wife_and_kids.pdfIn PDF document text
  • https://6acf0ca1-aa41-4771-8b91-54baff69ee7f.filesusr.com/ugd/7d1dc9_b666a9b7e5aa4fee98b5c2488cc32abd.pdf?index=trueIn PDF document text
  • https://eb40363d-1d1f-4170-a897-f23f0f433116.filesusr.com/ugd/2a1429_069acfbfecf049f0a4a5cd0d42cece8e.pdf?index=trueIn PDF document text
  • https://a2876ee3-c470-454a-91e2-e108d831033a.filesusr.com/ugd/e8dba5_b9c1ac603fd34e358a31fdaea2a018f1.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/73ea867e-a20e-4065-8ea1-c489a41a7ec6/10668180717.pdfIn PDF document text
  • https://6525eaf8-9a42-4119-9fb4-c3d475b3b78e.filesusr.com/ugd/80bfa9_d50ae49117db4b799ff385ee9273608f.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/c314f291-3fc3-40e8-902c-523d2244d1e2/71845197900.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6acc26eb-677c-4100-94f9-2d043c7b9187/popular_childrens_fairy_tales_list.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.