Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://krisoc.ru/pbw?utm_term=all+i+want+for+christmas+is+you+to+go+away PDF link annotation

  • https://static.s123-cdn-static.com/uploads/4446399/normal_5ff76622792a0.pdfIn PDF document text
  • https://xedukigujidazan.weebly.com/uploads/1/3/4/5/134512451/nesarebojovipeja.pdfIn PDF document text
  • https://tofeniva.weebly.com/uploads/1/3/4/6/134625175/wizafefuxulazofak.pdfIn PDF document text
  • https://fejovixojik.weebly.com/uploads/1/3/4/3/134333762/7639040.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4486548/normal_60135adee9f0d.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4409818/normal_60b89fcf73f59.pdfIn PDF document text
  • https://didaripetog.weebly.com/uploads/1/3/4/6/134685212/3713996.pdfIn PDF document text
  • https://sanivuledaxefe.weebly.com/uploads/1/3/4/2/134234591/f3b414.pdfIn PDF document text
  • https://lonawojalokofa.weebly.com/uploads/1/3/1/3/131382346/dixekum.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4460477/normal_604a1b2c6c085.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://wimarolos.pbworks.com/w/file/fetch/144509415/verint_impact_360_user_manual.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d31cd2d7-827d-4edf-87a6-4795975b29d7/how_to_test_reading_fluency.pdfIn PDF document text
  • http://tubekikewabi.pbworks.com/f/tryst_with_destiny_objective_questions.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/45fb5693-bfe6-406a-9d72-95147d6151ac/niveles_normales_de_ferritina_en_covid.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2e545559-860d-4e37-bbef-376394b25d0a/huawei_hg635_firmware_update.pdfIn PDF document text
  • http://nugewil.pbworks.com/f/34940559367.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/71f7b7ca-594a-4e5e-bafa-b95d01fbc4cc/37149764202.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7962521e-5d04-4f8b-b8c6-7aa410112731/49524745317.pdfIn PDF document text
  • http://mapaduzipi.pbworks.com/w/file/fetch/144506421/balazafu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/903feab8-8d63-4dc8-b4bc-10344f3f9224/36239240762.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2e589615-0cf4-4f49-8f31-f5ccb6d9b5b0/graco_pack_and_play_changing_table_pad.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/53dbf822-9dbf-4ec5-af8c-c4de33217049/98342317851.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/04df3bf0-9922-440c-b302-c0d38303443d/books_of_the_bible_old_testament_funny_song.pdfIn PDF document text
  • http://vogituvu.pbworks.com/w/file/fetch/144980163/download_windows_10_highly_compressed_in_10mb_iso_file.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e60df093-6e2a-4279-adfd-bb9440638cdd/muroraki.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.