Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Brand-impersonation credential phishing lure critical SE_BRAND_CREDENTIAL_PHISH
  Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: action link to abused redirector https://konomotawet.weebly.com/uploads/1/3/1/3/131379362/9251777.pdf.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://xajibur.ru/strik?utm_term=dork+diaries+book+8+pdf+free+download PDF link annotation

  • https://konomotawet.weebly.com/uploads/1/3/1/3/131379362/9251777.pdfIn PDF document text
  • https://matatotasewitux.weebly.com/uploads/1/3/1/3/131384286/zozezimof.pdfIn PDF document text
  • https://lunidopufakim.weebly.com/uploads/1/3/4/4/134482460/zaromipabed.pdfIn PDF document text
  • https://rubexanow.weebly.com/uploads/1/3/5/3/135346757/68e80fe2e036b2c.pdfIn PDF document text
  • https://wurulukonena.weebly.com/uploads/1/3/5/3/135398735/e2b3d6a1d312b.pdfIn PDF document text
  • https://jizawabule.weebly.com/uploads/1/3/5/9/135966138/sewux-xanogugekuvo-pekarofu.pdfIn PDF document text
  • https://zugipevewepa.weebly.com/uploads/1/3/1/4/131483317/jujol.pdfIn PDF document text
  • https://zavisedifigi.weebly.com/uploads/1/3/4/3/134316550/6419220.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/61d769a1-7228-478c-a9c9-bb47982d4b2f/store_vnitien_sur_mesure_leroy_merlin.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bc26e841-b98a-4714-9bfa-48ed4fe19861/24735962334.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/be4dc46f-b4ce-45d2-8a3b-edc9884b0de6/buxusazebumonow.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/419c0583-0ce6-4771-984a-cc204300244d/56115193605.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1ad4d80d-993a-4e24-b35e-a419636f9e27/55216036724.pdfIn PDF document text
  • https://s3.amazonaws.com/wiwamoxamo/bubilonobepurovipotaris.pdfIn PDF document text
  • https://s3.amazonaws.com/piradi/danikigamu.pdfIn PDF document text
  • https://s3.amazonaws.com/nakevoja/viwesizafa.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/09e10506-cdac-4c01-98a7-b9ad5b9cf600/64713915604.pdfIn PDF document text
  • https://s3.amazonaws.com/suzixegazunow/how_to_prepare_for_power_bi_interview.pdfIn PDF document text
  • https://s3.amazonaws.com/xonobijikivo/47286167091.pdfIn PDF document text
  • https://s3.amazonaws.com/satuja/8393335103.pdfIn PDF document text
  • https://s3.amazonaws.com/viromibukoleliw/39780766843.pdfIn PDF document text
  • https://s3.amazonaws.com/vinivuxo/install_phpspreadsheet_codeigniter.pdfIn PDF document text
  • https://s3.amazonaws.com/xarojapi/petosurinigifomofovozamet.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/09183296-d403-46f0-aec7-29d61c58edf0/what_are_the_unreliable_sources_of_health_information.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8b2f25c7-2c4b-4830-bdf5-5376ce43420e/you_before_me_movie_download.pdfIn PDF document text
  • https://s3.amazonaws.com/fowikorejodi/69875430300.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • https://savannah.gnu.org/projects/freefont/In PDF document text
  • http://www.gnu.org/licenses/In PDF document text
  • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.