Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ponafet.ru/wix?keyword=minecraft+plastic+texture+pack+1.12.2 PDF link annotation

  • http://roselosudeve.sportsontheweb.net/celestron_astromaster_70az_telescope_blue.pdfIn PDF document text
  • http://lirinevewafa.mypressonline.com/ibm_selectric_repair_near_me.pdfIn PDF document text
  • http://poposiruta.mywebcommunity.org/mesoperegojukepalajuxi.pdfIn PDF document text
  • https://ruwevuvav.weebly.com/uploads/1/3/5/3/135387918/6486075.pdfIn PDF document text
  • https://zanixikowupu.weebly.com/uploads/1/3/1/4/131437740/babofin.pdfIn PDF document text
  • http://favodokoleti.mypressonline.com/39697973516.pdfIn PDF document text
  • https://pukakiliratof.weebly.com/uploads/1/3/4/7/134768090/4354376.pdfIn PDF document text
  • https://gejeximiba.weebly.com/uploads/1/3/4/8/134897602/a3e1498.pdfIn PDF document text
  • http://pefiworawodud.mypressonline.com/38909100699.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/0af88f21-30b8-4e84-932e-66bdeb8f9356/what_is_the_main_theme_of_the_stranger.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ea630d44-ee52-40c9-a776-6849cfb35a05/oxford_picture_dictionary_2nd_edition_english_arabic.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e91a0ac3-34fe-4541-909c-1ba03db26d70/13117256138.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/927b6dcd-ae6f-4c2a-b513-6525541da970/why_dont_my_desktop_shortcuts_work_anymore.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2173210e-4958-4502-9787-f12b7e01697b/dosabopigiwivevumedibij.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1cab0414-1bd9-45d2-8b03-36b5c05a9f87/motorola_23_mile_range_-_22_channel_two_way_radios.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2ed32b59-4cf0-42fc-814a-206877cca1c2/23461244477.pdfIn PDF document text
  • http://penanaras.myartsonline.com/susoxazutu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dc40a3ae-f083-4e4f-bd2b-79c19983d19c/lateral_thinking_questions.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b2a60d52-06f5-4d24-a7e1-cbb9e9a81019/tegokijo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/95ed5733-b82d-4e3f-91fd-3c4e0a98686c/interview_questions_and_answers_south_africa.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3cc55c30-0794-4a0a-a588-172300d16b15/cal_osha_forklift_training_video.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1bb3f2e0-5698-4371-9c7c-bef2ad04ace4/bitenu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d6916631-e6b0-4c3b-a6ee-93eeac9102f3/precio_del_libro_curso_de_milagros.pdfIn PDF document text
  • http://dapufojutujat.atwebpages.com/john_deere_sabre_mower_deck_removal.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.