Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://xajibur.ru/strik?utm_term=ipad+mini+2+and+3+same+size+case PDF link annotation

  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/a8b20969-8de3-4ddf-8527-834d18a2de0d/regular_and_irregular_verbs_worksheets_for_grade_3.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b1ca5fd7-8e5c-4eb2-9829-59d092d6b647/what_is_the_best_english_grammar_reference_book.pdfIn PDF document text
  • https://0ffdd24b-620b-4f4d-94ef-a39da1ca20bd.filesusr.com/ugd/853ce2_ea861412d9ff45779dc7538fdeb95bab.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/1d79e2e3-9a35-41a5-90ab-14be98a417fb/vutuxalowubidepa.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a60ee3d8-3c62-4930-8bec-f64e3e7ac983/bible_commentary_in_telugu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/92cb7218-d3fb-445b-8b0a-d192b9709ae9/37956352984.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4eec0f39-d4d6-4854-b279-b0bb9defb8e4/xirulujexiwikigunaviname.pdfIn PDF document text
  • https://55963656-6eb1-4b25-bcd5-bb835d65808b.filesusr.com/ugd/0064ae_38b5896a48e541f9a2a5113a10855641.pdf?index=trueIn PDF document text
  • https://ca108e69-7b6b-43f0-8f16-d96ebeb8a33d.filesusr.com/ugd/79e0dc_dcc05bc734ec499a9fcbfe0bee26dbc3.pdf?index=trueIn PDF document text
  • https://5090c2af-253d-40c3-bfb7-942fc6db26b0.filesusr.com/ugd/0511f5_cf972ca4f1a34fe3be516ee03ccef9c3.pdf?index=trueIn PDF document text
  • https://c36efdde-2309-4ce2-a10d-b6df2ce12cd8.filesusr.com/ugd/e98059_61143a0e0763444491e9ca54b8b0a8c3.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/bda47ff5-d4d3-4ca2-a756-7809577bd4d0/soluciones_molares_formula.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1e18352c-cb41-4e56-932e-ceb9bf7873f9/9911133108.pdfIn PDF document text
  • https://37523d11-79cf-4eb3-ada4-f05de57c71ee.filesusr.com/ugd/275374_6817ff483f574520985fc844f6a3ceb7.pdf?index=trueIn PDF document text
  • https://a04ad255-06d6-4b17-97e7-91173d300295.filesusr.com/ugd/6864df_b62bf0b78f654169b29d1e0a86a73d0f.pdf?index=trueIn PDF document text
  • https://a7563df4-ba19-4d82-a8a0-b2470d957038.filesusr.com/ugd/61f964_86e461bcc3c74feb99d7cb6c64b3b88e.pdf?index=trueIn PDF document text
  • https://141ebdc9-a3c9-4c6d-b8f9-366dbf139dec.filesusr.com/ugd/46bfb0_9cdc401829f44ea58164cb19c9b99261.pdf?index=trueIn PDF document text
  • https://3ae4d138-4ba3-4962-98fb-1b98b40a6a82.filesusr.com/ugd/38062a_b87d4eb12d914e8f8df1e5a16243dd60.pdf?index=trueIn PDF document text
  • https://f3b8d348-8566-49c9-a9f8-a2c3b9e1bc8e.filesusr.com/ugd/f1c748_7a3c106843e44bce84d0ae7b34a66ade.pdf?index=trueIn PDF document text
  • https://1682489e-d94b-4f22-b6a6-c8ecb623ca2e.filesusr.com/ugd/5f226e_3396ebbbefa14fd681f44113a78ac94b.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/9bb8c1d3-6d18-427a-87c9-2f4bf2c1b0ce/yard_machines_snowblower_8hp_26_inch_manual.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bec9883b-e7b2-405c-b3de-ae30dfbe84a0/67768456716.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.