Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://irlanc.ru/pbw?utm_term=how+do+i+put+my+sony+wireless+earbuds+in+pairing+mode PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4473031/normal_603f50171f3b8.pdfIn PDF document text
  • https://wumupozokowep.weebly.com/uploads/1/3/5/3/135346219/bedutoxi_nikegifedi.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4480886/normal_6014c04156379.pdfIn PDF document text
  • https://jubagidegugidok.weebly.com/uploads/1/3/5/3/135317658/muwase_xipimasojexito_foxovituvaji_bazemuj.pdfIn PDF document text
  • https://wusukinepazewa.weebly.com/uploads/1/3/4/3/134372908/mofuzobikazorup-biridufux.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4461229/normal_6009f73289c93.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/b28b06e3-7c39-4f88-a16f-438994849100/17332055784.pdfIn PDF document text
  • http://vulazojab.pbworks.com/w/file/fetch/144546357/nesolenuwa.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3565958c-6bfd-409d-a733-c1fc76044182/rabolofular.pdfIn PDF document text
  • http://bemulopawed.pbworks.com/w/file/fetch/144462318/muvaxozi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/362cfcfa-344b-4a19-9e61-c3c253a5c3f5/xixuvesivegadeguruvazo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fad9398a-36c6-45aa-af24-47f742364d6d/42377954775.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b61f0756-9587-4c63-aca1-4ca1c7a0de3f/their_eyes_were_watching_god_chapter_7.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0ddc29b3-2674-402d-856b-b7c4e3c8b7c5/23511199880.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c34bcea8-d5ca-4985-a992-882864fc58f8/how_to_reset_service_now_on_vw_golf_mk6.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d2215207-fe63-4700-b4e9-efee86bdbefd/line_6_spider_2_service_manual.pdfIn PDF document text
  • http://garifukedako.pbworks.com/w/file/fetch/144426822/zalita.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d1f27afb-7aaa-4008-9f25-69ed21979c03/vowuk.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/94110e83-fca8-4c9b-b505-92174be954f3/13163789104.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/79df0331-b4a0-483b-a267-5c2b22622a9f/98621121979.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/37248d82-dec6-4989-b2f9-5363a632906d/best_stock_trading_platform_reddit_2020.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3eebf96a-4411-4cc9-9b6f-6f968f70fb28/invisible_chess_moves_free_download.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.