Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://maypoin.ru/strik?utm_term=sig+p229+40sw+review

  • https://gezofixerofale.weebly.com/uploads/1/3/4/4/134458649/1891407.pdf
  • https://mapulanedubo.weebly.com/uploads/1/3/0/9/130969056/fovobomegogi-tesazetosi.pdf
  • http://xinuvaro.sportsontheweb.net/rapul.pdf
  • http://kesawalaxok.iblogger.org/34537672613.pdf
  • http://vapurese.22web.org/maryland_driver_s_permit_study_guide.pdf
  • http://www.ascendercorp.com/
  • http://www.ascendercorp.com/typedesigners.html
  • http://pupagerirawax.myartsonline.com/zeteja.pdf
  • https://07d68bf2-0661-47e2-9ffe-eae068a071af.filesusr.com/ugd/fef806_a4270e1452ef4654b478b8ffcd5fb3f1.pdf?index=true
  • http://fusuzuveraku.epizy.com/93223735522.pdf
  • https://s3.amazonaws.com/xazarujokemus/1001_arabian_nights_tamil_download.pdf
  • https://s3.amazonaws.com/xetasif/95272545102.pdf
  • https://9d1e48ad-bcd7-4831-9b7b-7108443a63b6.filesusr.com/ugd/136d07_53bb889b20424d99ba3d08d2c37682e4.pdf?index=true
  • https://3c59ccad-08dd-474b-8af0-a42d91f20399.filesusr.com/ugd/489ff0_9ed4a709e65442a586413cd9ddff5928.pdf?index=true
  • http://dozopedatofol.atwebpages.com/90415132419.pdf
  • https://s3.amazonaws.com/rodakarugupoko/centre_de_formation_blanchard_avis.pdf
  • http://misibinebob.epizy.com/distance_between_two_points_worksheet_with_answers.pdf
  • http://kofaxafogi.myartsonline.com/nilajimolulupewemosuj.pdf
  • https://43dda2ad-fadc-418c-a2d5-4b96cca2ed60.filesusr.com/ugd/6eca9c_f5e9019ef7b24905871520e0298f471f.pdf?index=true
  • http://jigosip.epizy.com/28211701363.pdf
  • http://pojozija.onlinewebshop.net/capacity_building_in_education.pdf
  • https://s3.amazonaws.com/tibitexil/63235867763.pdf
  • http://goguvero.epizy.com/de_bono_books.pdf
  • http://mesilixogu.rf.gd/inorganic_chemistry_shriver_atkins_free_download.pdf
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • http://purl.org/dc/elements/1.1/
  • http://ns.adobe.com/pdf/1.3/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/rights/
  • http://scripts.sil.org/OFL

Open this report in the interactive analyzer, or submit your own file for analysis.