Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://botokaw.ru/123?utm_term=ali+wong+hard+knock+wife PDF link annotation

  • http://buzatukati.iblogger.org/persuasive_language_ethos_pathos_logos_worksheet.pdfIn PDF document text
  • http://redatimiwanal.iblogger.org/zedofigibuxusa.pdfIn PDF document text
  • http://rapiwanijisage.scienceontheweb.net/domain_driven_design_c.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/voxulija/bill_of_sale_georgia_form.pdfIn PDF document text
  • http://jozobudesurarab.onlinewebshop.net/assignment_first_page_format.pdfIn PDF document text
  • http://dimuwebogikufuf.rf.gd/free_table_of_contents_powerpoint_templates.pdfIn PDF document text
  • https://s3.amazonaws.com/gazijewevan/dim_vba_sheet.pdfIn PDF document text
  • https://s3.amazonaws.com/vososasoxumete/lirojixolimubedotegilug.pdfIn PDF document text
  • https://f4b9ed98-44c1-44e6-9966-d9817cd43de7.filesusr.com/ugd/9ced5d_978918ca21914eb895efa1afd06c24de.pdf?index=trueIn PDF document text
  • https://feedbc21-cb93-402c-9ae2-3476589645d2.filesusr.com/ugd/f3ecbe_800ccf7f06164e7d9f4d9c27a4ea7263.pdf?index=trueIn PDF document text
  • https://77a80da1-97a3-4b40-ba11-54c6d232eb66.filesusr.com/ugd/39a0fd_b6c9808777eb4d07aaef073e64d9eff6.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/xuvamuba/vetolunoxatijozexovixew.pdfIn PDF document text
  • https://d67926d6-99fe-48a4-938f-95006fdf2de6.filesusr.com/ugd/21d82e_7f46b26a512d4de5933d98063255a4fe.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/paxivogedewilu/29217062130.pdfIn PDF document text
  • https://8e8ef6ac-913c-489f-8395-c30730e7ba0a.filesusr.com/ugd/f39c52_127898b831dc423f9ce7ae33c56ceb2f.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/pibabopuduj/24001457046.pdfIn PDF document text
  • https://c33b9ccd-b51c-4983-b12c-9660feb698e0.filesusr.com/ugd/1fa6dd_98e164853e8f4a8d90550c4dc6d73a27.pdf?index=trueIn PDF document text
  • https://49b7c339-fea6-4bb3-bf7b-ca47af5263df.filesusr.com/ugd/6ca12d_9dde01705efe4e7ab7d6fccf4db1c7d5.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/setikizo/how_to_start_a_community_action_group.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.