Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Callback phishing phone lure medium SE_CALLBACK_LURE
  Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://seumenha.ru/strik?utm_term=how+do+i+make+an+appointment+at+the+ny+dmv PDF link annotation

  • https://gomimujexewawid.weebly.com/uploads/1/3/1/0/131070583/gopuwoxafe.pdfIn PDF document text
  • https://pipabujul.weebly.com/uploads/1/3/2/6/132680817/tudosudesuvalod.pdfIn PDF document text
  • https://bigudiwox.weebly.com/uploads/1/3/5/3/135304820/nepufate-lewibinopekap.pdfIn PDF document text
  • https://pegofugetil.weebly.com/uploads/1/3/5/3/135347090/9376426.pdfIn PDF document text
  • https://rubuvewoxuvima.weebly.com/uploads/1/3/4/8/134873715/8049868.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/dojivewobasuval/flowchart_creation_guide.pdfIn PDF document text
  • https://4900ecec-7ac1-411c-be2c-b077674085c8.filesusr.com/ugd/493135_886d083b37324ca580cc02ccab0462d9.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/ceec270a-b95b-4c5c-9c74-f2a18991558b/hampton_bay_universal_fan_remote_instructions.pdfIn PDF document text
  • https://ef5e9b3f-1a8e-4c79-9b60-34b8f8133c96.filesusr.com/ugd/18574e_3da7c01b2fc84478bd49dc2eecada0f8.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/zafaronivaj/borbaad_songs_320kbps.pdfIn PDF document text
  • https://s3.amazonaws.com/wipotegadodorek/22334965784.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4a6e45f7-5c8c-4cc3-b916-caad43d77288/how_to_deep_clean_a_fiberglass_tub.pdfIn PDF document text
  • https://s3.amazonaws.com/dusubonifu/bridging_visa_form.pdfIn PDF document text
  • https://ca3ec1ac-6ff7-4c8f-ae0f-86a30d86e335.filesusr.com/ugd/3615fb_9cd50bb8fa5641f4a7115ead632dedc4.pdf?index=trueIn PDF document text
  • https://c945751c-610e-4f4b-8d8c-4431096f0ac5.filesusr.com/ugd/f34823_6a1b1e3d1bb747119eb809a58fc3c861.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/f9bf8460-bce1-477e-bccb-91165f67da13/47882959686.pdfIn PDF document text
  • https://s3.amazonaws.com/palevijuj/michael_jackson_will_you_be_there_free_willy_soundtrack.pdfIn PDF document text
  • https://e1eccfe9-8888-4f52-a155-e9c8e84e0752.filesusr.com/ugd/4fb05f_f337ed9c1a244ad88354da46c2c6ac7a.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/jivuxo/79157874769.pdfIn PDF document text
  • https://a765b249-d442-4b07-8ea9-8318d996b894.filesusr.com/ugd/902d29_17c4037febcc47e2983d5d94b7e477b4.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/45136f65-fa55-4aea-be3b-366903737a30/70593483624.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c8988038-2a01-4c88-864e-f841de76c194/spinoza_ethics_latin.pdfIn PDF document text
  • https://s3.amazonaws.com/ruzaganog/pibepe.pdfIn PDF document text
  • https://s3.amazonaws.com/nelizenejakarug/how_to_add_citation_in_word_using_zotero.pdfIn PDF document text
  • https://s3.amazonaws.com/xelimewat/java_version_8_download_linux.pdfIn PDF document text
  • https://a161ff94-1a6f-4367-b6f8-8e513a5e676d.filesusr.com/ugd/4c7633_1aadd74819f147ebaa98ad9921748e00.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.