Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://maypoin.ru/strik?utm_term=dean+koontz+jane+hawk+book+5 PDF link annotation

  • https://cdn.sqhk.co/tabewinudeka/ci3GeKs/marshall_football_roster_2018.pdfIn PDF document text
  • https://cdn.sqhk.co/wezopexa/Byt1hfg/95234355864.pdfIn PDF document text
  • https://cdn.sqhk.co/mejomusajob/gTKohjt/13558915472.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4473049/normal_5ffaa6d2d1d79.pdfIn PDF document text
  • http://jabudapitu.scienceontheweb.net/duwaner.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4417206/normal_5fc6a03a1c50c.pdfIn PDF document text
  • http://vopukisavenif.medianewsonline.com/inflectional_morphology_and_derivational_morphology.pdfIn PDF document text
  • http://sitizinudex.getenjoyment.net/pl_sql_book_download.pdfIn PDF document text
  • http://xokebidukefu.getenjoyment.net/zozilaregizosisu.pdfIn PDF document text
  • https://cdn.sqhk.co/pedidagow/5i6hgig/peruxakovemikodiwoxabi.pdfIn PDF document text
  • https://cdn.sqhk.co/lunabati/iiiiCje/superbike_riders_1998.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/af550393-586e-40b2-baa8-9202fbfed6ae/what_is_the_chemical_structure_of_olive_oil.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1d398cc4-3f55-4717-855e-56b02b527d6d/tewarez.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a3a287e9-fc6f-4b6a-9a3f-8a2735436986/2001_subaru_outback_engine_3.0l_6-cylinder.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/575762b9-9320-45e9-8269-adaf45d9907f/28224501897.pdfIn PDF document text
  • https://83f018a0-8e49-44f0-b57e-805e464a5f06.filesusr.com/ugd/10a4aa_5b759e50b0f8462bae86ee5914dfe5ca.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/89ec5169-f4f4-41f1-a18e-ed68f4ab48c2/casio_wk-6600_76-key_workstation_keyboard_with_power_supply.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bc1e6eca-aa17-4760-a5b9-8c8cd3b14b31/how_many_carbs_are_in_a_burrito_supreme.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c7cc74a7-f846-42ca-b6d3-e533dbf450aa/what_is_rate_in_reading_fluency.pdfIn PDF document text
  • https://f72e0e13-a873-49c5-9cb5-3c2848b8c5b2.filesusr.com/ugd/f8ba4b_65f127526a28412b9ca9e62a4b006e42.pdf?index=trueIn PDF document text
  • https://fad58b31-c538-4d3f-828d-7998eec853b9.filesusr.com/ugd/7e6083_366250c9b20246869ee8b49cd5d42f82.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/0629ea17-c901-4770-8aa6-cc6e35afcaf4/xavunet.pdfIn PDF document text
  • https://67d298e0-85f4-4ad4-bf36-e1ac857e42fc.filesusr.com/ugd/b6bf5b_df98173ccbb84866ad348fc0ef13430f.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/ee77263e-b9fc-45ea-a90e-dda1c59dd96b/68217267845.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.