Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
  Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://nipisod.ru/award?keyword=how+to+blur+background+in+photoshop+cs6+pdf PDF link annotation

  • http://shopeuro.pro/leisure_bay_spa_partsggebt.pdfIn PDF document text
  • https://solekavugixe.weebly.com/uploads/1/3/3/9/133999951/9138587.pdfIn PDF document text
  • https://cdn.sqhk.co/nowonipewo/iigibia/tubing_in_colorado_river.pdfIn PDF document text
  • https://cdn.sqhk.co/bisuligiga/d7vU8ha/commander_cody_lego_figure.pdfIn PDF document text
  • http://getplafond.xyz/nietzsche_genealogy_of_morals_essay_2xxcmd.pdfIn PDF document text
  • http://nibajafij.medianewsonline.com/bernina_830_manual.pdfIn macro / runtime command snippet
  • https://gonufefimexej.weebly.com/uploads/1/3/4/8/134892828/207394c6b4.pdfIn PDF document text
  • https://susejovidexoxi.weebly.com/uploads/1/3/0/7/130775922/fedakadir.pdfIn PDF document text
  • https://ribekafov.weebly.com/uploads/1/3/4/7/134761657/nidutilegotazome.pdfIn PDF document text
  • https://cdn.sqhk.co/mamidusidozu/jdidhiM/learn_basic_spanish_to_english.pdfIn PDF document text
  • https://cdn.sqhk.co/muligumixe/IJhcPmq/best_captions_for_pics_with_sister.pdfIn PDF document text
  • http://tunabamilusi.mypressonline.com/geological_time_scale_2020.pdfIn PDF document text
  • https://noremovex.weebly.com/uploads/1/3/4/8/134883944/pesunobedifodif_zukijenonolur.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/6d911d48-c5a8-4c00-902a-573655ac5781/nimugapobuwedilolik.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8b93050e-94b2-4573-ad20-f2817a8fbe03/59409235031.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/04b07dfd-296a-4b76-afcb-27f7858e2b68/watch_the_pit_and_the_pendulum_1991_online_free.pdfIn PDF document text
  • http://lavoxema.onlinewebshop.net/21327234551.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/07d57288-69eb-4d32-8e8d-2c7e7b5084be/how_to_oil_euro_pro_sewing_machine.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3d7368ba-3782-4d96-8fc9-ca71a1bec005/komagakitetuzobilido.pdfIn PDF document text
  • http://vekisofekibote.myartsonline.com/17108183554.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8bf071af-80bb-406d-8b37-13b124164dfd/lisolisujolawuxokefopek.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e3be97a2-8108-4746-8a2b-eabdef0fb8a6/digital_marketing_evening_courses_dublin.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/74156bbb-f7da-4ab0-a6b4-3b63c1e557e8/resokufov.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ec990374-40d7-4482-a3fa-1f91660fc0ab/how_to_pair_turtle_beach_bluetooth_headphones.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • https://uploads.strikinglycdn.com/files/07d57288-69eIn macro / runtime command snippet
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.