Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://irlanc.ru/pbw?utm_term=pubg+camera+sensitivity+settings

  • https://fiziwiminika.weebly.com/uploads/1/3/4/6/134686918/bososusudake_kelelojomuzi_zujujobonoja.pdf
  • https://cdn-cms.f-static.net/uploads/4463010/normal_60325d47d6bae.pdf
  • https://cdn-cms.f-static.net/uploads/4386092/normal_6069728cb7454.pdf
  • https://xikefopu.weebly.com/uploads/1/3/4/7/134748362/kivub.pdf
  • https://fuxogadukuka.weebly.com/uploads/1/3/4/6/134688721/roxajafurur.pdf
  • http://www.ascendercorp.com/
  • http://www.ascendercorp.com/typedesigners.html
  • http://jaxonewu.pbworks.com/w/file/fetch/145141188/make_magazine_free_download.pdf
  • http://xelivolofuso.pbworks.com/f/99192767866.pdf
  • http://magobok.pbworks.com/w/file/fetch/144783765/how_to_cheat_on_edgenuity_exam.pdf
  • http://kolasotosexu.pbworks.com/w/file/fetch/144759810/20403256295.pdf
  • http://negaboxa.pbworks.com/f/essential_toxicology_casarett_doulls.pdf
  • http://demogotujod.pbworks.com/f/farabe.pdf
  • http://legesir.pbworks.com/f/51583392415.pdf
  • http://pamotekegopa.pbworks.com/f/wagojit.pdf
  • http://jozeluwofe.pbworks.com/w/file/fetch/144425793/examen_de_matematica_para_primer_grado_de_primaria.pdf
  • http://divusoriwa.pbworks.com/w/file/fetch/145075770/75364964393.pdf
  • http://biwonuv.pbworks.com/f/german_textbook.pdf
  • http://lufokomarib.pbworks.com/w/file/fetch/144561084/wogapuxamojawegof.pdf
  • http://kisagew.pbworks.com/w/file/fetch/144866553/gizesafativiregojojujowug.pdf
  • http://xulajirose.pbworks.com/f/71895297378.pdf
  • http://munonoraze.pbworks.com/f/free_crochet_doll_dress_patterns_for_beginners.pdf
  • http://tesesazef.pbworks.com/f/86097265525.pdf
  • http://lesokulovisu.pbworks.com/f/19635131898.pdf
  • http://fepewuwakow.pbworks.com/w/file/fetch/144487617/rise_of_the_super_germs_science_world_answers_september_17_2018.pdf
  • http://vazufatar.pbworks.com/f/saftirik_serisi_indir.pdf
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • http://purl.org/dc/elements/1.1/
  • http://ns.adobe.com/pdf/1.3/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/rights/
  • http://scripts.sil.org/OFL

Open this report in the interactive analyzer, or submit your own file for analysis.