Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://resalured.ru/strik?utm_term=is+there+a+brandy+melville+near+me PDF link annotation

  • http://pawomodom.medianewsonline.com/53564126647.pdfIn PDF document text
  • http://gozimudowojuzun.mypressonline.com/98918884684.pdfIn PDF document text
  • http://sidufapas.mywebcommunity.org/can_i_rent_an_apartment_without_a_lease.pdfIn PDF document text
  • http://gelufose.scienceontheweb.net/forklift_training_courses_melbourne.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/xamibebulosaxug/89800024171.pdfIn PDF document text
  • https://6f2fb29c-15f2-4b08-b525-3eb91a7f0a41.filesusr.com/ugd/c3548c_dcde83e5e47a487b92af6bab5caadcf4.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/vazisi/nipepedojijovoxotuzija.pdfIn PDF document text
  • https://ede8a7a3-2377-4e09-926a-401222b31c25.filesusr.com/ugd/81c89d_4c54116d34264d6faacc0b1edb1b3802.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/e3b4c255-1bd3-4292-a992-3ef42f6188b8/punctuation_exercises_for_grade_5.pdfIn PDF document text
  • https://s3.amazonaws.com/limepusotanal/what_is_your_management_style_quora.pdfIn PDF document text
  • https://ac25a69f-a984-4293-9c3d-8c9e0f062535.filesusr.com/ugd/cbf077_3644f6b408564f0bbd2f43fb77644099.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/a36e4cb2-027b-40cb-93cd-e3b4ee7f04be/is_there_a_phone_number_for_facebook_marketplace.pdfIn PDF document text
  • https://b9a4c3d6-4ccf-4d04-9b0f-c2e9c357e15d.filesusr.com/ugd/e5cbe5_cf1d09845f4e48b7b6ecde3bf2d43f1e.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/d776d530-160f-4db7-9728-1ad3435171ad/next_game_of_thrones_book_2019.pdfIn PDF document text
  • https://08b4a39d-fa16-4eaa-91be-ae90003cacb9.filesusr.com/ugd/237bf7_efaea42433a74660a504b3c2440f4bd8.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/558b3065-389a-42b0-a2bf-e3761997e533/virginia_woolf_to_the_lighthouse_review.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/20b80187-6d5d-4476-80d3-508375729422/avantree_audition_pro_double_beep.pdfIn PDF document text
  • https://5e54824a-8208-41b0-8aeb-7c017e8cfb46.filesusr.com/ugd/f64db8_e1516c3868d04516a4e61ff437afcd8d.pdf?index=trueIn PDF document text
  • https://60f6da8c-824c-4163-aae9-6195f2ac7ed4.filesusr.com/ugd/7f16bd_d14f8bfabf4a46c1a6904655fcde439c.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/legipalofi/kajivudufifela.pdfIn PDF document text
  • https://e6a48395-9ebc-465e-8505-c4b20d7b8e72.filesusr.com/ugd/81e12b_e6b17b1e4c334db7b0d96985ff46b5e5.pdf?index=trueIn PDF document text
  • https://5fb3b2f4-e86d-4029-b823-ac5950ddf4c1.filesusr.com/ugd/c0aa49_716f31f113614d9fbcf53ff88621b4fa.pdf?index=trueIn PDF document text
  • http://damowepoko.myartsonline.com/nitutetarivi.pdfIn PDF document text
  • https://95a57b4d-a24c-4412-bd87-88f4f885d252.filesusr.com/ugd/011e4b_b694c2315abf45bc81a18c42a93553ce.pdf?index=trueIn PDF document text
  • https://a146b927-ed54-472d-b3a8-6b137e313b92.filesusr.com/ugd/4d400c_0d7e07e91bbf4e40b7e21396a17a1718.pdf?index=trueIn PDF document text
  • https://354df738-7a8c-4643-bdcd-aa58f7c4bd0c.filesusr.com/ugd/69cf62_f8c7392ab742413ea6fe990d6355e75d.pdf?index=trueIn PDF document text
  • https://73f4d879-981c-49fe-abc7-520f36a14a84.filesusr.com/ugd/b77b08_5c14854a388944d1919799cf6ea962ef.pdf?index=trueIn PDF document text
  • https://551f0ad2-75d1-4009-b90b-2f3e3e20230b.filesusr.com/ugd/c2bf0a_327d22ff619c4e0e9e750b31401b95f5.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/muvevanepen/lovagore.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.