Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Callback phishing phone lure medium SE_CALLBACK_LURE
  Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://lozipotod.ru/123?utm_term=chemistry+sample+paper+2019+pdf PDF link annotation

  • https://komidozikozapuf.weebly.com/uploads/1/3/1/4/131455883/pakimifanisoruvubob.pdfIn PDF document text
  • https://wajifisawebe.weebly.com/uploads/1/3/4/4/134480175/ruxeleve.pdfIn PDF document text
  • https://xopekasas.weebly.com/uploads/1/3/4/7/134748476/7547133e34ef4cf.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/de0f5184-4a2c-44ff-866b-014e88168fe5/personas_en_la_vida_real_del_cartel_de_los_sapos.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0e3fd721-5748-4b79-9a01-bcf98f1c421f/a_knight_of_the_seven_kingdoms_read_online.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fa81de32-ee40-48c8-b28b-eab1213a3609/61399636287.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e8f2670d-d8a5-4a02-8e67-e11703f2c68f/sig_sauer_p239_357_extended_magazine.pdfIn PDF document text
  • http://xuruzinijub.pbworks.com/f/20764894260.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/66171743-45fe-4aaf-a936-9ff93f2b0624/22085061860.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/741c1fae-5546-4f32-adad-b98797369e4e/what_are_the_4_types_of_conditionals.pdfIn PDF document text
  • http://nusometa.pbworks.com/f/logenarikate.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/06e49a73-d735-40b5-b793-4c52b499c186/sakujovipema.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9c189b87-1036-4dea-bb6e-c211e79329e1/14096428882.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/478f3236-3a44-46a2-82f3-d4953df0fc14/warhammer_fantasy_miniatures_for_sale.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/77db8df5-f927-43e5-b70f-cfaa40fa4793/44545526800.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/95653a95-b859-4b75-9a78-7b1458d2933a/75560602373.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f182c783-68fe-4081-b6fe-1cad180551d2/pateviwawozat.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/322284ba-d1bf-49ed-938d-52b3979635cf/49019195169.pdfIn PDF document text
  • http://kepojijudiva.pbworks.com/f/how_to_not_renew_a_tenants_lease.pdfIn PDF document text
  • http://tirotibixup.pbworks.com/w/file/fetch/144783789/xawitodafupod.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.