Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://resalured.ru/strik?utm_term=bedtime+stories+for+adults+to+fall+asleep

  • http://ejinaya.com/maus_2_spiegelmang1hw3.pdf
  • http://qunit.space/larufawigodenixudigefie0nvh.pdf
  • http://edalovert.xyz/dujidiweselekatomoziojdw0.pdf
  • http://itwow.info/3508585808520893.pdf
  • http://baxijemapuzoxu.22web.org/bertrand_russell_in_praise_of_idleness.pdf
  • http://fly-drive.online/best_free_antivirus_for_android_phonescl5hi.pdf
  • http://sunny-web.ru/strategy_presentation_template_freewo8ti.pdf
  • http://legko.travel/model_3_range_moderumzv.pdf
  • http://www.ascendercorp.com/
  • http://www.ascendercorp.com/typedesigners.html
  • https://0e9c393c-9feb-4465-ae9d-4486bea7a644.filesusr.com/ugd/4b68be_9c9bde061acf4fcf9ad68ee54e08d77b.pdf?index=true
  • https://uploads.strikinglycdn.com/files/4922334e-88b9-4837-ac41-3df112b7f650/how_to_get_bestowal_ninjutsu_sekiro.pdf
  • https://uploads.strikinglycdn.com/files/578b0195-bbb3-4615-93b1-d8e7bb5fbb8e/43367418638.pdf
  • http://pavinudoj.epizy.com/gangster_games_apk_for_mobile.pdf
  • http://kajonefev.rf.gd/93350053122.pdf
  • http://kujarison.rf.gd/linksys_rvs4000_default_password.pdf
  • https://23da7c74-6e14-424a-b22a-901aa35eafb1.filesusr.com/ugd/9cc572_a6d2279e98724af2857622b61d869697.pdf?index=true
  • http://jibogifimot.epizy.com/bozibaminedov.pdf
  • https://uploads.strikinglycdn.com/files/73c3f3f8-7d1c-411b-b17d-b96592775a86/13923260140.pdf
  • http://pevoxetawalob.rf.gd/63689024929.pdf
  • https://9c12218e-e157-4070-b33f-4467b3cb42bb.filesusr.com/ugd/0c60a0_eecb7406b1dc47a9946543e09ec7f22b.pdf?index=true
  • https://2a983b51-2e13-4971-8c1f-a5bca3ab4353.filesusr.com/ugd/e1a791_5370bc5fe9cc443c9cd32529946a9cfe.pdf?index=true
  • https://7915398d-c9c2-4241-abdb-40cf742e4b8d.filesusr.com/ugd/d4df0f_604ee539997f40e78d5a5f074f6cea25.pdf?index=true
  • http://lalukegadugubu.epizy.com/italian_pronunciation_guide_cc.pdf
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • http://purl.org/dc/elements/1.1/
  • http://ns.adobe.com/pdf/1.3/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/rights/
  • http://scripts.sil.org/OFL

Open this report in the interactive analyzer, or submit your own file for analysis.