Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
  PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dafemum.ru/aws?utm_term=how+to+make+money+in+stocks+book+philippines In PDF document text

  • http://buvanerupapuko.22web.org/50996073167.pdfIn PDF document text
  • http://nizuxep.iblogger.org/68687290297.pdfIn PDF document text
  • http://zujonatuvetivux.iblogger.org/testout_network_pro_answers.pdfIn PDF document text
  • http://gijasigekafafuz.iblogger.org/history_books_free_download_in_urdu.pdfIn PDF document text
  • http://jumovuv.22web.org/baccalaurat_en_informatique_et_gnie_logiciel_7316.pdfIn PDF document text
  • http://senenetikoxikom.22web.org/sodawituv.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://42e65457-ec34-4553-8979-78b6e302f774.filesusr.com/ugd/f1976d_6a38fb402a894caa9c92f73333f85a75.pdf?index=trueIn PDF document text
  • https://a62e46b8-d933-4087-892c-e5439cec6991.filesusr.com/ugd/e9cba9_1e91bc7e5ff34ca59af5b10c654fa1ab.pdf?index=trueIn PDF document text
  • https://8d67285a-e3c5-4820-bb1a-bb91ce1079a6.filesusr.com/ugd/d54300_addbc4fd96aa410a8231fb42acd8f88d.pdf?index=trueIn PDF document text
  • https://f98f40d2-b649-4e6b-99af-b89bbf2331ff.filesusr.com/ugd/724bd4_96c8168a8aa840b68f092673255a2279.pdf?index=trueIn PDF document text
  • http://powiwuroda.epizy.com/bohemian_rhapsody_piano_sheets.pdfIn PDF document text
  • https://d54d55f4-8004-4613-9f19-7b96cbed0ae7.filesusr.com/ugd/ce4b32_05d17856f9d44ac79566a33f3099b00e.pdf?index=trueIn PDF document text
  • http://xunevonobi.epizy.com/ipcc_land_report_guardian.pdfIn PDF document text
  • https://6e345194-e688-4037-aa24-2ff230a16836.filesusr.com/ugd/ce9fe1_d88b9d1bc3454faeb12930a5264bea5a.pdf?index=trueIn PDF document text
  • http://mizujem.epizy.com/ejercicios_de_pronombres_relativos_en_ingles.pdfIn PDF document text
  • https://0bdb67af-4c57-4a6e-9706-714cc80719f5.filesusr.com/ugd/fc840b_3e58759b5d0c4fbbabd0e773a92b4ddd.pdf?index=trueIn PDF document text
  • https://17c3d818-7f64-4152-976a-2fa997d7a7be.filesusr.com/ugd/e2c250_63da7585507e457ab3b22702f992f2b5.pdf?index=trueIn PDF document text
  • https://d6236f05-450e-4b96-9875-1783d83c708b.filesusr.com/ugd/912de2_6951014f652d439e8b6650408d0a452a.pdf?index=trueIn PDF document text
  • https://9c50f6df-e9c1-453e-a208-eff1cefe231f.filesusr.com/ugd/44b3dc_4e8be047aafc4993a2f67e7677a57259.pdf?index=trueIn PDF document text
  • https://810dce77-56ab-4324-823a-3549757f4eab.filesusr.com/ugd/1fad07_8004bfc03c3d455b9e2dbfddca7698a4.pdf?index=trueIn PDF document text
  • http://mijumepalus.rf.gd/unhandledpromiserejectionwarning_error_chromium_revision_is_not_ed.pdfIn PDF document text
  • http://milibelibagusez.epizy.com/tumor_de_cervix.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.