Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Urgency / deadline lure low SE_URGENCY_LURE
  Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://vilenefex.ru/wix?keyword=the+breathing+method+penguin+readers+pdf PDF link annotation

  • https://nivujetomut.weebly.com/uploads/1/3/4/7/134753784/ffb981556816.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4475216/normal_5fd1ac3c48b53.pdfIn PDF document text
  • https://vefoxetewezelir.weebly.com/uploads/1/3/1/4/131483279/279f00859a8ad9e.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4470380/normal_6044dd8c0027d.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4384323/normal_5ffa7b22862e4.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4403946/normal_5fcfa7e8c1583.pdfIn PDF document text
  • https://taxajefikudo.weebly.com/uploads/1/3/4/7/134765143/221.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4481397/normal_5ffdca93aac7e.pdfIn PDF document text
  • https://jokojizo.weebly.com/uploads/1/3/4/5/134509913/potagusidometet.pdfIn PDF document text
  • https://fakivafepupu.weebly.com/uploads/1/3/0/8/130873921/6892518.pdfIn PDF document text
  • https://zefisuket.weebly.com/uploads/1/3/4/8/134868467/xefid_pusirokivuki.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4479235/normal_6055257b7d4a4.pdfIn PDF document text
  • https://mebijanuwirat.weebly.com/uploads/1/3/4/0/134042853/wetirakitow-libagiw.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://334e481f-4595-4613-8514-cf1b68b0f675.filesusr.com/ugd/a5bb32_a2bc2219f8b84167a1374e85c889a42d.pdf?index=trueIn PDF document text
  • https://1de4b56a-3309-4767-83a2-f1bb1ea7c594.filesusr.com/ugd/a6e5e9_e6355a0f97fc4fbba5716d9cc99e19a3.pdf?index=trueIn PDF document text
  • https://cef8af8d-7071-4339-ac50-fc417d371010.filesusr.com/ugd/a89196_645a58f3f27b4d92a6d0c2a01295eecf.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2e787ff3-4be4-4c66-8431-d5ce06a6e2b1/how_to_connect_vizio_sound_bar_to_samsung_tv.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/59aad19c-39e3-41cb-949a-9e80bb43cd38/fairbanks_morse_z_engine_manual.pdfIn PDF document text
  • https://969948a0-d7f7-4827-958e-a3856fee42d4.filesusr.com/ugd/9d40bc_cb974e9118df428db362fcd57c8b5a7c.pdf?index=trueIn PDF document text
  • https://332892e0-6a2b-40ad-946e-e7c92c61c867.filesusr.com/ugd/3e5d97_9077315665c04e139eea9556459fd90e.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/08232e51-2688-4c8d-807f-298188523237/libanimiliwadubivisug.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.