Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dugedepap.ru/wix?keyword=lord+of+the+flies+map+chapter+1 PDF link annotation

  • http://zisuroto.mygamesonline.org/cant_connect_to_my_linksys_extender.pdfIn PDF document text
  • http://xijulefabogi.getenjoyment.net/examples_of_imagery_in_romeo_and_juliet_act_2_scene_2.pdfIn PDF document text
  • http://crubr.space/43750703838ylgc0.pdfIn PDF document text
  • http://itanto.space/i_cant_help_falling_in_love_with_you_lyrics_and_piano_chords42jt5.pdfIn PDF document text
  • http://kekewawoxugar.sportsontheweb.net/33894056919.pdfIn PDF document text
  • http://kutatit.getenjoyment.net/how_hard_is_it_to_set_up_a_wordpress_website.pdfIn PDF document text
  • http://nijaxubazaziw.mypressonline.com/how_to_remove_lint_filter_from_lg_washing_machine.pdfIn PDF document text
  • http://civiliscmq.online/890682548666buan.pdfIn PDF document text
  • http://xepidenad.scienceontheweb.net/how_to_become_a_computer_architect.pdfIn PDF document text
  • http://sagedix.medianewsonline.com/why_is_my_stackable_washer_not_draining.pdfIn PDF document text
  • http://tk-pobeda.site/31122199369tfk8k.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://pijularof.epizy.com/wilewa.pdfIn PDF document text
  • https://1a2149e7-ca7f-4e7c-a584-0e483de6f3af.filesusr.com/ugd/9219f8_4fe3bbdf086f4a3db3da27ea6c2cb016.pdf?index=trueIn PDF document text
  • https://67dec473-0a9c-497c-80b1-62a4c84c5046.filesusr.com/ugd/0aab01_5a37e588ad7e4c61bd1bd291d6ec21be.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/fc28069c-90e5-4fcc-addc-3cab0d1a37ad/how_to_get_rid_of_pimple_marks_and_scars.pdfIn PDF document text
  • https://a0bbd489-bf03-48a0-8e93-88abd0751e5b.filesusr.com/ugd/370ea2_e185e78a4aba4fb6bbbfddcf14392d00.pdf?index=trueIn PDF document text
  • http://mebupeb.rf.gd/21366078981.pdfIn PDF document text
  • https://b01cffea-7a05-49e8-9781-04202a21c04b.filesusr.com/ugd/d5d855_fe1b6f471c034751b609d6a7033da3ea.pdf?index=trueIn PDF document text
  • http://tonavisuma.onlinewebshop.net/pre_service_teacher_education_concept_nature_objectives_and_scope.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fa1e9566-c463-41bc-9d1c-b65212af8427/65499941067.pdfIn PDF document text
  • http://gejebegujisutil.rf.gd/good_food_and_wine_guide_perth.pdfIn PDF document text
  • http://pawuzax.onlinewebshop.net/tixowab.pdfIn PDF document text
  • https://6674166f-eb58-46b1-9d38-a528bc95e02c.filesusr.com/ugd/e38d8e_389f2403f40449be8d234c4a144aaf03.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/31e23cda-ed86-4b64-aef2-823a3e597729/94139727522.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/90d03194-abe0-4568-a470-1542f1a5d721/towowogigevazomuju.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e41ab916-8fd4-49b0-9692-4def5cb655cf/go_go_elite_traveler_charger_lights.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.