Malicious PDF — malware analysis report

Heuristics 8

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Security software disable instruction high SE_SECURITY_BYPASS
  Document instructs the user to disable antivirus or security software — unusual for ordinary documents and high-risk in an unsolicited file
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://soxebez.ru/123?utm_term=kindergarten+babysitting+game+full+version+free PDF link annotation

  • http://comforfemj.fun/ravabutanitifubokomovd7vr.pdfIn PDF document text
  • http://byseles.xyz/how_to_fix_a_leaky_hose_spigot4fvd6.pdfIn PDF document text
  • https://cdn.sqhk.co/sidamebo/hrIOwyR/62311860208.pdfIn PDF document text
  • http://autolombardpro.ru/the_kiss_of_deception1ek59.pdfIn PDF document text
  • https://cdn.sqhk.co/tokebamojos/SYogh3H/freeze_dried_strawberries_recipes.pdfIn PDF document text
  • http://tipografiyav.moscow/33514493740hdcje.pdfIn PDF document text
  • https://cdn.sqhk.co/ravawiku/zRAI2hd/just_between_us_journal_nz.pdfIn PDF document text
  • https://cdn.sqhk.co/fusaduxuw/MgiKggf/hollywood_escape_hints_level_7.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://e691ad07-92dc-45fa-af10-8929b4045ede.filesusr.com/ugd/87b9a8_8d0a5296b0be4d9fbf8c086d0ae1ea3c.pdf?index=trueIn PDF document text
  • https://8a7e94d2-1b07-4399-8a7b-cfebf1eb419e.filesusr.com/ugd/e78b77_e2381182af4e40d6b5b2dcb40ff14720.pdf?index=trueIn PDF document text
  • https://2489a575-72f7-492f-b117-28cfe4a4d2a3.filesusr.com/ugd/d81705_0cf4686291c94eababca15f411ec6cba.pdf?index=trueIn PDF document text
  • https://f8340159-69ce-4309-ac43-521e9a8475b4.filesusr.com/ugd/bc0b97_2d8c50ca6b1e49ab8994cf25bfb11abc.pdf?index=trueIn PDF document text
  • https://0f7a2101-273c-4f7f-b1fd-079d1ad923c1.filesusr.com/ugd/a7ea6f_b1405cb75f534a2c9f99142d7235a6ce.pdf?index=trueIn PDF document text
  • https://198d5876-2e36-4a54-a59d-b4c1060b65be.filesusr.com/ugd/4733ca_4ca37373922940489e1cabe6d48ab4dc.pdf?index=trueIn PDF document text
  • https://9e7b01ce-91ce-414a-93c5-ade8df4b7359.filesusr.com/ugd/cfbfd2_bea14956313c4c0eb70bd9510c2cefcf.pdf?index=trueIn PDF document text
  • https://d70b1dc8-7d09-4148-9854-e6a7cae1b87b.filesusr.com/ugd/5899d5_0d2f048511194e49b3daa6476799865b.pdf?index=trueIn PDF document text
  • https://cbb9655c-b60d-4095-8c1c-bb5f9a2903c5.filesusr.com/ugd/4dd980_667ca18c89374553a3fce52efada1e2d.pdf?index=trueIn PDF document text
  • https://aa4c2489-c93b-4667-afab-104bf5323bad.filesusr.com/ugd/8b49c6_1bfdecfeae3046d3b12be60159ee6601.pdf?index=trueIn PDF document text
  • https://3cd6846c-369c-4875-9c63-132df726a2dd.filesusr.com/ugd/7ab50f_9458e967c1f248238d71c423e9de9058.pdf?index=trueIn PDF document text
  • https://59bb578d-b312-442a-858b-1a1a54b18a6c.filesusr.com/ugd/c79b1c_3f2e13c26c124bada072d243d9bdbe93.pdf?index=trueIn PDF document text
  • https://17851959-1482-4b49-8222-7b7b0c628459.filesusr.com/ugd/3cb679_6b6606a5c2ce49bd893890701ff8168f.pdf?index=trueIn PDF document text
  • https://43cb2d18-1589-43a7-b1c5-fe1278e1c76d.filesusr.com/ugd/370b54_73be2ba2f89143ca9510905ba38c27ef.pdf?index=trueIn PDF document text
  • https://850a36a1-966c-46c3-86ed-e15bcb5778a7.filesusr.com/ugd/ede58b_3d04909d1d4b4e469ffc250d99007e67.pdf?index=trueIn PDF document text
  • https://76ed6b59-b034-43ac-b949-e1c08f76e3cb.filesusr.com/ugd/ee6100_3d8878517e5a41d485357cba85e844e5.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.