Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dafemum.ru/strik?utm_term=why+my+maytag+dryer+won%2527t+heat In PDF document text

  • https://cdn.sqhk.co/jirowolad/hbie91c/95334454444.pdfIn PDF document text
  • http://magic-spring.com/vsphere_client_6._7wneeb.pdfIn PDF document text
  • http://idealicaufficiale.website/pitezivagewebaminaval0lm82.pdfIn PDF document text
  • http://uanews.website/9124155376226lg1.pdfIn PDF document text
  • http://it50off.pro/what_is_acidic_and_basic_buffers7rlt.pdfIn PDF document text
  • https://cdn.sqhk.co/dijabidasu/4ojjVhb/latigo_in_english_word.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/44c40ba7-5c07-442d-96d9-c6a2f7986263/84353822288.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/aa2234dd-435c-4b38-ba80-6da346e2a3b2/94183693367.pdfIn PDF document text
  • https://9e1b5e4e-b4ab-405b-8fdf-b3b6d7b19c28.filesusr.com/ugd/94ea38_78f2b72c72ae47a48869691719c22d99.pdf?index=trueIn PDF document text
  • https://cfecb619-c0f5-418d-ae9d-b1147643389f.filesusr.com/ugd/4cd51e_6a7307360b5541fdb7d3fd376f5a946d.pdf?index=trueIn PDF document text
  • https://fb3efafe-1b0e-41a1-9434-8bf556110c4a.filesusr.com/ugd/de5e41_e239f06689d941229f7948c019b6d345.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/57c1bdad-b855-4187-b113-8539b0af6c84/gakagedowuligeje.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4868657d-d2e4-40f6-ad4b-01ec8b939efe/amana_front_load_washer_error_codes.pdfIn PDF document text
  • https://944bcc21-9f45-42c2-9889-8cf837fa5d1c.filesusr.com/ugd/50f869_1fff0400525d4273a8863af69f47aaa5.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/d7c91001-28f3-4463-81ec-feedf9b44014/ledapitotitolunulaz.pdfIn PDF document text
  • https://26f2e344-8444-46ea-90c9-5a893bcc2fb3.filesusr.com/ugd/b8c837_66c4ce240a5d4117b39fad688a59f39f.pdf?index=trueIn PDF document text
  • https://3caa4030-7dd6-4be4-8a8a-e1981c45b3cd.filesusr.com/ugd/704988_ba509d7bb76c4f6997173b4d171de34c.pdf?index=trueIn PDF document text
  • https://b634734f-67aa-4edc-9b69-dcf7610e4690.filesusr.com/ugd/c86859_b89368a072fa434a9ad401cf52ecd05a.pdf?index=trueIn PDF document text
  • https://1e16da7b-5b4f-4122-a3c4-5c88c9d97cf7.filesusr.com/ugd/83f04e_c583492d0ef347ceac223e3e774d4146.pdf?index=trueIn PDF document text
  • https://3e1af3dc-cf37-4f58-935d-0a6065bc5ce9.filesusr.com/ugd/3ca236_9af1e3424d86467aa147ceded5a0b638.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.