Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://leonvi.ru/strik?utm_term=download+yeh+rishta+kya+kehlata+hai+latest+episode PDF link annotation

  • https://zufulakoloti.weebly.com/uploads/1/3/5/3/135301661/2670797.pdfIn PDF document text
  • https://static.s123-cdn-static-d.com/uploads/4409826/normal_60b006577d8ba.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4450730/normal_6026d5121d71f.pdfIn PDF document text
  • https://pemesekisubabas.weebly.com/uploads/1/3/4/6/134659876/fomafamad-duganetalaxif.pdfIn PDF document text
  • https://zixixowiw.weebly.com/uploads/1/3/4/6/134605173/4e61c179ced58cf.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4365546/normal_601924254e1be.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4474465/normal_5ff1ceacdc5c4.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4367294/normal_601d520b902ce.pdfIn PDF document text
  • https://xilorufanil.weebly.com/uploads/1/3/0/7/130739938/kokurifebukoturexomo.pdfIn PDF document text
  • https://niladituzisum.weebly.com/uploads/1/3/4/7/134736231/7e3d8108.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4409114/normal_6062294537446.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4422893/normal_602a2aaa9230a.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4463528/normal_5fe0340db063c.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4402261/normal_600d488eef012.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • http://fedorahosted.org/lohitIn PDF document text
  • https://uploads.strikinglycdn.com/files/785b42d6-3cc1-4e9a-8deb-721e6497e097/99167984148.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b4432bda-4925-4938-9936-5d29bb4bae0f/50772626253.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7300c4a2-a7e1-4cce-b632-9dced26f5367/congruent_and_similar_shapes_games.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cc6b8a7c-0bb7-47e0-ab32-45a71bf066a3/98181500351.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/37227ce8-1916-4cbd-8a1e-1ba756fe1d00/best_saturday_night_clubs_in_atlanta.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/76758c23-ffbf-4a17-941f-7506155d938c/el_diario_de_greg_14_resumen.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1c4e87cc-f23c-468f-90b7-233c43eb844d/53036637814.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8a76f024-202e-4cbe-80cb-a3b3119d5014/descargar_grand_theft_auto_vice_city_para_android_gratis_apk.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5d076a8c-7d30-4ef3-8524-75fd2ae18331/what_is_the_main_purpose_of_a_literary_analysis.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/eb1b8e12-b9bf-4ede-8ef9-6d29dd9bdb42/how_to_treat_a_dog_with_demodex_mange.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1073c7b2-b1db-41a2-8ace-2ef019daf83c/can_you_track_regular_envelope.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4e37fcc9-e3b4-4e53-ae1d-1016948f974d/hp_4500_not_printing_black.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.