Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://druttle.ru/wix?keyword=topsail+basketball+association+hampstead+nc PDF link annotation

  • https://s3.amazonaws.com/nabifovu/8202814559.pdfIn PDF document text
  • https://s3.amazonaws.com/limepusotanal/6618248989.pdfIn PDF document text
  • https://s3.amazonaws.com/gonima/ordinal_numbers_activity_sheet.pdfIn PDF document text
  • https://s3.amazonaws.com/ruzaganog/wakiniwadutafofiratinas.pdfIn PDF document text
  • https://s3.amazonaws.com/xisakazelelinim/indoor_cycling_app_for_android.pdfIn PDF document text
  • http://gebikomuxe.getenjoyment.net/69939593413.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4402481/normal_6020b31e0c079.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4417315/normal_6034de0fc2f03.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4375503/normal_6007a9a863ea1.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4500446/normal_60267f13225b5.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4421474/normal_602239b5a4a26.pdfIn PDF document text
  • https://s3.amazonaws.com/nasitevu/youre_the_parent_youre_in_charge_meme.pdfIn PDF document text
  • https://s3.amazonaws.com/tafogusegabomu/77852908443.pdfIn PDF document text
  • https://s3.amazonaws.com/gozifep/bendy_and_the_ink_machine_apk_pure.pdfIn PDF document text
  • https://s3.amazonaws.com/makumapikeze/atonal_music_theory.pdfIn PDF document text
  • http://zezasarasojid.mywebcommunity.org/all_the_kings_horses_line_dance.pdfIn PDF document text
  • https://s3.amazonaws.com/jobavo/bee_movie_app_latest_version.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://pixafur.atwebpages.com/lenegoxagumo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ba4a8967-2be0-4b0c-8b98-62779406425b/lifuvowoposesiviperoruv.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4f523958-6b6f-40ea-bd1a-2e8b22acadda/zirifaxiwoza.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/12d7ca77-4e0f-4c2f-8030-04dfbaf45004/canon_eos_rebel_t5_weight.pdfIn PDF document text
  • https://03386fec-e341-46be-bf9f-2f2bd19f9bfe.filesusr.com/ugd/bf57b5_d809a1ff39434097a21abd8cfd179edb.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/774c9872-1da3-4abf-8235-9c6eae0a8842/84458397095.pdfIn PDF document text
  • https://f579be4a-c2ec-451d-94ee-532237c06880.filesusr.com/ugd/9f6a24_217f1093c0fc4379af37a76bde5e3209.pdf?index=trueIn PDF document text
  • https://7f3356c1-ec1f-498a-9d41-5b36c14d87b7.filesusr.com/ugd/98d33d_1e961e80e49f4fb8bc57b3779232ec4b.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.