Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dafemum.ru/award?keyword=chainsmokers+something+just+like+this+piano+pdf In PDF document text

  • http://euromarket.pro/taylors_theorem_proof_in_real_analysisdocbe.pdfIn PDF document text
  • https://povutepumik.weebly.com/uploads/1/3/2/7/132741486/5a138ae.pdfIn PDF document text
  • https://bopilopuneliniw.weebly.com/uploads/1/3/5/3/135304065/998d59.pdfIn PDF document text
  • https://petovowatudero.weebly.com/uploads/1/3/1/6/131606592/genidife.pdfIn PDF document text
  • https://fubuwadedaxas.weebly.com/uploads/1/3/4/8/134897716/jikapofaguzag.pdfIn PDF document text
  • https://sorafenime.weebly.com/uploads/1/3/4/3/134320910/4cfbb837aea4e.pdfIn PDF document text
  • https://maruvape.weebly.com/uploads/1/3/4/8/134854924/pavokupelu-botimu-kebejokukebigar.pdfIn PDF document text
  • http://meetsalle.xyz/5e_phb_freebria2.pdfIn PDF document text
  • https://zuzatalo.weebly.com/uploads/1/3/4/3/134326893/9539391.pdfIn PDF document text
  • http://shopyou.online/2018_ford_mustang_gt_premium_pricej00k0.pdfIn PDF document text
  • http://usesalle.xyz/how_to_replace_a_ford_escape_key_battery6kbkb.pdfIn PDF document text
  • https://natapoja.weebly.com/uploads/1/3/0/8/130813782/silexidilegeg.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://e108c0fa-8e70-4110-aab7-e0d30777705f.filesusr.com/ugd/d9966b_6032161de6794683ade75e70403472ff.pdf?index=trueIn PDF document text
  • https://f59c0a4d-c104-43ac-8966-a5978cdf1b8c.filesusr.com/ugd/0c1ebd_7fc6407a672845cbb742361db4d1b31b.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/4476108b-74bd-46a2-ae30-6a1c4cf3faf8/how_to_wind_a_bobbin_on_a_necchi_sewing_machine.pdfIn PDF document text
  • https://a12a05ab-6462-4855-b086-b0a2a961d6d8.filesusr.com/ugd/2c76f4_7ecd5dcba4b949d9a545eb65c62935a3.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/245b0446-490f-4b8f-9e45-d3b561a1582c/mexotovuxopapipun.pdfIn PDF document text
  • https://f856bbc4-01c8-45e4-8891-a53c5ee59fd0.filesusr.com/ugd/8e827e_3784cfa07fd94c07a533c8fb6a6e6c7a.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/17ba9f3f-2fdb-4e75-ab5d-c23635441f61/dark_souls_3_guia_completa.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6496c175-c6cb-4ceb-bedc-094891c7c1bf/how_to_reset_acer_aspire_e15.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8f67ded3-f397-4ea9-b9dc-d72eb0605e0e/how_to_determine_level_of_care_substance_abuse.pdfIn PDF document text
  • https://76bf42c0-7447-45ed-8dd3-33f9786ae3ae.filesusr.com/ugd/ba2c19_ddbea6b429c74b6b81c62370a06ccc23.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.