Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://midufefew.ru/strik?utm_term=how+to+connect+liftmaster+garage+door+to+wifi PDF link annotation

  • http://mepamoso.sportsontheweb.net/awards_and_prizes_2020.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://6c8ebe11-725c-420b-823a-68bc39d02ad2.filesusr.com/ugd/3e87bf_4121fd787c474be4b3cca26ea6c857bd.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/7357f461-ffa6-4408-8ad8-194f4bad1fee/paduta.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6f4a149d-1613-4bab-a9bd-78bc3c9687e3/zedemimowixe.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4bb5c9d0-7e29-4b8b-b091-7c6d6b4ce921/rebizozedifuluzunabomob.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/113c2a29-c1ad-4f8d-94f0-5c856c0d0cb1/does_netflix_have_cloud_atlas.pdfIn PDF document text
  • http://suxudogakol.myartsonline.com/why_wont_my_garmin_watch_turn_on.pdfIn PDF document text
  • https://s3.amazonaws.com/wupixufekijax/california_domestic_violence_and_mandatory_reporting_law.pdfIn PDF document text
  • https://s3.amazonaws.com/zoromexemuzid/what_does_epiphany_mean_in_greek.pdfIn PDF document text
  • https://9334512a-4df1-45dc-8804-f0fa1d9e2a3d.filesusr.com/ugd/9466eb_b7f652edab1c4224b466e5887ee0d941.pdf?index=trueIn PDF document text
  • https://ae8c1479-5121-4009-b0ed-8259dbb1205b.filesusr.com/ugd/0aff45_edc8542b504b40bfbaf173837d55d427.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/wixanarer/android_vs_ios_market_share_japan.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6aaf79f5-6333-4223-9336-3c103f09c912/rujazakuzigomukovixene.pdfIn PDF document text
  • https://0a497e50-07dd-462d-832d-d8678f741a8e.filesusr.com/ugd/5f857b_03dc3f4d583d4fc5aebd862e6e072c38.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/61ec9f5f-a53c-42f7-b5d1-03205ff3af90/cisco_dta_170hd_troubleshooting.pdfIn PDF document text
  • https://e1c07d4e-6587-4767-b76f-5dea9cf3e327.filesusr.com/ugd/51a829_3ddc410928c54da1840f9f5af0487625.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/8c23e58d-39f8-401e-b661-5dec092a304a/wendys_chili_nutrition_facts_sodium.pdfIn PDF document text
  • https://f39f7cea-6337-46de-af4f-699959e6db0a.filesusr.com/ugd/004672_1a4fd47365b74f09b1a1b0fb315d20ef.pdf?index=trueIn PDF document text
  • https://d2ea4bfc-f92a-4379-acf2-d9b69981ddb7.filesusr.com/ugd/739437_fe7b7f5de2894902a27d1570a0b175cd.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/bubeto/sivutarisidajapoxelupe.pdfIn PDF document text
  • https://f7cac2f2-528f-490f-9bef-cb2448a877de.filesusr.com/ugd/529ba0_88ef45adc454405c9f3f572ba86b72e1.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/eec3126e-efde-4bf5-9dfa-566875c8b99b/how_to_fix_ref_code_s0200_charter.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.