Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://lozipotod.ru/123?utm_term=tpi+712+flue+gas+analyser+manual PDF link annotation

  • https://zejofisedefumot.weebly.com/uploads/1/3/4/6/134667534/fipimilaja.pdfIn PDF document text
  • https://pelimabogex.weebly.com/uploads/1/3/4/6/134685965/c56f5571e2436.pdfIn PDF document text
  • https://genifefesabido.weebly.com/uploads/1/3/3/9/133999330/7285025.pdfIn PDF document text
  • https://jetakazam.weebly.com/uploads/1/3/2/8/132814031/4cd1834a194.pdfIn PDF document text
  • https://zifofuxe.weebly.com/uploads/1/3/5/3/135386801/fbd5d3.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://45ed8376-e832-497f-ab20-0a31924dc5db.filesusr.com/ugd/4b7290_b17baad64694497d952be2bd489257de.pdf?index=trueIn PDF document text
  • https://14535e1a-360a-4d01-a655-fa33e115c80e.filesusr.com/ugd/b222ea_0ea326c2ed6b4bb3993101a3e30df0b0.pdf?index=trueIn PDF document text
  • https://12563b6f-2a3b-446c-9027-cab6e698e5df.filesusr.com/ugd/610d21_df8674cf44f84c838e046accb2dee3a6.pdf?index=trueIn PDF document text
  • https://650c977b-0274-48a2-8498-43c0efc39f4e.filesusr.com/ugd/dbad32_4ae989ab6ae0464da75f8251f2f588ef.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/senodiw/animation_movies_in_telugu.pdfIn PDF document text
  • https://30f21d72-2b41-4965-a7bc-2abb02bf1ded.filesusr.com/ugd/47e66e_7b9b9dd5305b4cb1be30af89f8bd6d04.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/de9b23c5-82f1-49fe-b1e6-6e4b137c844f/lady_of_the_lake_movie_2018.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/eef2e101-f5cf-4620-bce5-a6a5511dc4d5/jonezeroje.pdfIn PDF document text
  • https://s3.amazonaws.com/rurovikejigibu/anne_hathaway_les_miserables_performance.pdfIn PDF document text
  • https://s3.amazonaws.com/defipedibe/telejezidututesere.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/adf7465a-2dbd-4907-b6f7-2ecf6cc9a53a/47359559430.pdfIn PDF document text
  • https://a95edb9d-21e5-46e4-bb1b-b1fdf66a5dae.filesusr.com/ugd/09e34a_e95be9887e2340d0a44e75e9ead88883.pdf?index=trueIn PDF document text
  • https://21e323bd-7fdd-46e9-a6c7-4880e76d7610.filesusr.com/ugd/0a51c1_49e1eceb88754a2ba1da8e24037f8ce0.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/lanorolowu/sniper_elite_4_trophy_guide_ps4.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d1eff104-9537-423f-b901-ab5fcd9ec0e3/how_long_do_die_hard_batteries_last.pdfIn PDF document text
  • https://s3.amazonaws.com/kofabube/mistweaver_monk_guide_8._0.pdfIn PDF document text
  • https://s3.amazonaws.com/midizaxopazeji/bazusovonuvoropomixadu.pdfIn PDF document text
  • https://436010f1-0dd7-4950-aec0-3bdf337573e8.filesusr.com/ugd/5a4c69_575b352cf3cb45c997b05138a154e11b.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.