Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Callback phishing phone lure medium SE_CALLBACK_LURE
  Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://resalured.ru/strik?utm_term=karr+security+system+ford PDF link annotation

  • http://olivamebel.com/82378014111drunc.pdfIn PDF document text
  • http://flipping-car.online/48183269009m565o.pdfIn PDF document text
  • http://teasmall.space/quit_claim_deed_pinellas_county_florida8vy4b.pdfIn PDF document text
  • http://idealica-uficiale.website/xfinity_stream_app_on_firestick_october_2020lapyb.pdfIn PDF document text
  • http://adanakebap.org/bulowofimadegipu43n4.pdfIn PDF document text
  • http://afracheat2.xyz/tevuvesakobejokitapowibusmz12.pdfIn PDF document text
  • http://normab-id.com/right_triangle_trigonometry_findingwn2ou.pdfIn PDF document text
  • http://geekcods.com/62890227441cbg0r.pdfIn PDF document text
  • http://rabota-plus.club/farewell_to_manzanar_audiobook1c2l9.pdfIn PDF document text
  • http://todayit.pro/h4350_load_data_6.5_creedmoor_143_eld-xvail1.pdfIn PDF document text
  • http://hookup157.site/what_angle_to_sharpen_a_chainsaw_chain2b0zq.pdfIn PDF document text
  • http://neyroskakalka.site/92592494563w4tsg.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/650ca67e-ccc1-4499-9c5b-d8af5af47dd5/finimudomisojafupuza.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9def08ac-44a2-4947-adf8-59970ae0c938/how_to_treat_pimple_marks_at_home.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5727244a-5f1a-4cd6-931e-8f1edeb992fb/game_of_thrones_beyond_the_wall_full_episode.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9bfa8072-49bb-43fd-9a5b-7cb5dadb02cd/t_maxx_2.5_axles.pdfIn PDF document text
  • https://2ac56fc1-f7ee-4366-9cb2-1681469c68ee.filesusr.com/ugd/b914b5_3cda3ca6e1df430a8f5f0e5f7f835148.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/601eb1f4-b1db-4017-9f14-054aa3c5fb56/hamlet_act_2_scene_3_and_4_summary.pdfIn PDF document text
  • https://39c10a3a-92c6-412a-a1bb-b8a1fc48fbc4.filesusr.com/ugd/259099_d36d1b6fd0d840069b6041d30c13c8d5.pdf?index=trueIn PDF document text
  • https://4e4301d6-cc9a-4939-960a-6b497c1efea6.filesusr.com/ugd/d78803_eb6cc4d187394a009d876e681e8716b1.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.