Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jottigo.ru/strik?utm_term=tommy+emmanuel+guitar+book PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4485156/normal_600ba06abffd0.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4489734/normal_6017a50e6cea0.pdfIn PDF document text
  • https://cdn.sqhk.co/xojelumegasi/jeeXza0/learn_c_free.pdfIn PDF document text
  • https://cdn.sqhk.co/tixunadegu/YGrwhjN/attunity_oracle_connector_performance.pdfIn PDF document text
  • https://cdn.sqhk.co/muxigatatini/ghdBEJI/16529138518.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4480743/normal_5fe4fb4ccddad.pdfIn PDF document text
  • https://cdn.sqhk.co/nisisepolo/u9ieTjj/11981350774.pdfIn PDF document text
  • https://cdn.sqhk.co/luwesefizi/sifjirR/ball_quest_destiny_2.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369769/normal_601bb865a4818.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://5ac9d038-517d-4536-97f6-676423289421.filesusr.com/ugd/b444d4_cacba9ab7e5b41e1bd46146d337c3f2d.pdf?index=trueIn PDF document text
  • https://2a085669-a8dc-40eb-b1d3-71ea9d660f60.filesusr.com/ugd/cafc24_872426cded75486a9fa4a169f65b0ee0.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/6587f556-efe6-4bc2-b139-51abc4bc7275/dopepamutemadir.pdfIn PDF document text
  • https://2080fafa-2491-4ac3-8118-a138f33bff34.filesusr.com/ugd/822ecd_46ab39ee8fac4617b54da0085948d7a1.pdf?index=trueIn PDF document text
  • https://be5a03d2-cb36-429a-bb4d-4773f067dd3b.filesusr.com/ugd/b46ca8_1a755a38d76b402e854d598281f5db62.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/b02bed66-b8b5-4b2e-b363-15cb040c5a22/56149410524.pdfIn PDF document text
  • https://1237a3da-0b33-4890-9ba9-974507bf2590.filesusr.com/ugd/3e0cb9_3d10fb3f29c24706ae9d93f934c8178e.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/a86e8cf6-4f0f-4794-9547-e8a3c70ca166/what_is_the_purpose_of_a_general_warranty_deed.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5d75e90d-0d7b-4d05-b8d2-e5ad122ade70/how_did_thomas_die_bible.pdfIn PDF document text
  • https://7ec9ed57-df89-401a-953b-45744c150cee.filesusr.com/ugd/6e3131_03cdb4db634948c98309a98e692a3e07.pdf?index=trueIn PDF document text
  • https://b03e51a8-7171-48c0-94d6-e4c032e6f37f.filesusr.com/ugd/9421c8_57b10af4cc604ff69ae07b09fa903763.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/4248bd4a-9953-47b5-bcd1-7b3413693bc7/27383632394.pdfIn PDF document text
  • https://8ed6bd9f-de2b-4923-b7df-82f95eb18a03.filesusr.com/ugd/7fa32f_211b37a46b5e4457ad8bf9cb76be9d99.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.