Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ketchas.ru/pbw?utm_term=what+does+it+mean+when+it+says+service+stabilitrak PDF link annotation

  • https://wofigazidiw.weebly.com/uploads/1/3/1/4/131437722/e87e947e40399.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4446776/normal_5ff22d51bad06.pdfIn PDF document text
  • https://jokazetesolibut.weebly.com/uploads/1/3/5/3/135314514/867492.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4417122/normal_5fcf679f2f246.pdfIn PDF document text
  • https://xemuvexakono.weebly.com/uploads/1/3/4/6/134655393/4171e3c312e75.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/b093918a-1596-49aa-b901-ed4e27f04ba2/laccord_du_participe_pass_avec_lauxiliaire_avoir_exercices.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/19167b82-1847-42b7-96ec-a052b9231339/what_are_the_three_branches_of_government_and_what_does_checks__balances_mean.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/42adc59a-0cf7-4549-8f34-d87ac0943ab6/eyelash_extension_client_record_form.pdfIn PDF document text
  • http://kiletejude.pbworks.com/w/file/fetch/144427578/wigemuj.pdfIn PDF document text
  • http://papoxuva.pbworks.com/w/file/fetch/144423429/nigitazijabasom.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/63281c0b-86ca-4769-a39b-0381f48c6e4c/ab_lounge_sport.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/61d7d837-6040-4095-bceb-1b3a864e5508/perry_chemical_engineers_handbook_r.h_perry_and_d._green.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/148d160c-326e-4ca5-833e-e0c348218cbe/tewakodo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/094653bd-8ec3-4a87-8425-7e9132363fe5/vonixisoraborilojusig.pdfIn PDF document text
  • http://kokoxudalux.pbworks.com/f/castle_defense_2_mod_apk_revdl.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/14a64263-0ca2-43f3-85b6-ec820c59e45a/mazitixedosikupop.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1e7cb5b0-ba4b-4fb8-8324-6e5be240a40f/how_to_troubleshoot_water_softener.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c6ab5cc1-ba8e-4f88-ad7c-532cd6314f6b/26756176207.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1039fcc6-696b-4f95-a22d-d2a8316e34dd/92117865516.pdfIn PDF document text
  • http://tazijebep.pbworks.com/f/need_for_speed_payback_ps4_mod_menu.pdfIn PDF document text
  • http://niwomif.pbworks.com/f/42056098039.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/54a50de1-e172-4d62-aa0a-cae86b9a63a2/sufaporurimujagadutolusiz.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6b9e52aa-c94e-4f41-a3ac-3efffa0cb7c9/the_strength_training_anatomy_workout_v2.0.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.