Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.NoRobot072134-9875396-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.NoRobot072134-9875396-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dafemum.ru/123?utm_term=billie+eilish+lovely+instrumental In PDF document text

  • http://fezelaradelemuj.22web.org/microsoft_authenticator_app_minimum_android_version.pdfIn PDF document text
  • http://supportcopyright.net/87263921538l3wld.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4423428/normal_604d8d252ce4e.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4367905/normal_60021c9fa63eb.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4476936/normal_600873f43907d.pdfIn PDF document text
  • https://cdn.sqhk.co/buzomesil/YCgjgg3/nepefosib.pdfIn PDF document text
  • http://znasila.ru/hoover_carpet_shampooer_not_picking_up_waterulv4u.pdfIn PDF document text
  • http://shopmzm.site/sepuzumifakazoghewti.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4444123/normal_5fce60440aa8a.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4379236/normal_5ff228127212a.pdfIn PDF document text
  • http://heliusdesign.ru/monkey_business_movie_thora_birch8z4q3.pdfIn PDF document text
  • https://cdn.sqhk.co/ruwopazeg/eHhfXL4/catalytic_reforming_in_petroleum_refining.pdfIn PDF document text
  • http://eurostore.info/mayabazar_telugu_movie_video_songs_freez2o78.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://e85625e8-91d5-48c2-95a4-67b7b95d5b39.filesusr.com/ugd/b97a97_ea062d9f4ab246468cebfbc78397ffb7.pdf?index=trueIn PDF document text
  • https://0e627107-309b-4451-a84d-e7064c41fccd.filesusr.com/ugd/04c368_459a7bba40e1466c930c127d0789a8b4.pdf?index=trueIn PDF document text
  • https://ffb80149-315c-4936-8637-e87477b606fc.filesusr.com/ugd/e7410d_6d8a79187b5c4ad993d84eb777db7190.pdf?index=trueIn PDF document text
  • https://0d3c4653-ec4b-4b04-9c20-59e348ba858e.filesusr.com/ugd/62200f_81f78a7a01014deb872a858d9b17b870.pdf?index=trueIn PDF document text
  • http://robajev.rf.gd/67911858454.pdfIn PDF document text
  • https://1e16f6d7-285b-4488-bf07-d3e24ac90e20.filesusr.com/ugd/417718_1f943b5a83ad4ea09438480534b6828a.pdf?index=trueIn PDF document text
  • https://84d655c4-d84a-4a0c-9c32-0387925bd622.filesusr.com/ugd/6233da_2d2bd0297667441299fca7bf7763ccfa.pdf?index=trueIn PDF document text
  • https://f1ddcea9-c323-452c-a4d3-aaefec61e50a.filesusr.com/ugd/defd8a_5fa3ac4e86fc4c1287f1d915d53279e7.pdf?index=trueIn PDF document text
  • https://0e67983c-e844-40c9-b604-97311ec94efe.filesusr.com/ugd/6e13d9_36708d2ed9d34b808e3955732cb09f33.pdf?index=trueIn PDF document text
  • http://sobegomogi.rf.gd/tutaji.pdfIn PDF document text
  • http://bofiragomux.rf.gd/99007761406.pdfIn PDF document text
  • http://nadilafirot.rf.gd/78044103129.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.