Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://leonvi.ru/strik?utm_term=gps+garmin+gpsmap+60csx+software PDF link annotation

  • http://bapatavusirave.mygamesonline.org/ranijodenalanonoxurena.pdfIn PDF document text
  • https://cdn.sqhk.co/lijedubejop/cjigdig/62096673919.pdfIn PDF document text
  • http://wasegulom.mygamesonline.org/argumentative_essay_definition.pdfIn PDF document text
  • https://cdn.sqhk.co/seseniluvus/johggBr/jevotosuzarofuvakusozewal.pdfIn PDF document text
  • http://fulokixowo.scienceontheweb.net/1001_books_you_must_read_before_you_die.pdfIn PDF document text
  • https://cdn.sqhk.co/wafifovuwel/ehifjiW/61286271807.pdfIn PDF document text
  • https://cdn.sqhk.co/vevigagexoxa/jP2gghj/world_editable_powerpoint_map_infographic_presentation_template.pdfIn PDF document text
  • https://cdn.sqhk.co/jerivudofin/ahiZij3/88208723333.pdfIn PDF document text
  • http://volulolusawaz.mygamesonline.org/50074242723.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://60659a61-a27b-47ea-8eac-a81775c62269.filesusr.com/ugd/7a7fb1_242247839c8e4bfeb41b57c9d095cad4.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/078b8c5b-29ba-4070-8b71-1ef776122ea4/77607526094.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b8393de1-1338-49fe-9833-7aa522b2cc68/76430049455.pdfIn PDF document text
  • https://0b7b936c-93ac-4a60-9644-6ba220b934cc.filesusr.com/ugd/b4bf80_c9f365c89b1e4e9fb2b27338a6533540.pdf?index=trueIn PDF document text
  • https://dbba0f06-1911-40f0-8c80-a2638c7f81cc.filesusr.com/ugd/b13fd1_a44ffa5ef7384d4eb4728fbb0d8eda81.pdf?index=trueIn PDF document text
  • https://eb72eaa1-ef55-40a3-a653-f6d21bccf295.filesusr.com/ugd/54913d_e5e02874bfb14731a00135224a9e9184.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/064e9ca1-8b1c-480c-b504-f68c411ba457/18060861852.pdfIn PDF document text
  • https://e108c0fa-8e70-4110-aab7-e0d30777705f.filesusr.com/ugd/d9966b_348e9bf1ea9d4644abf374f5aff3978c.pdf?index=trueIn PDF document text
  • https://74df6fe0-557b-4e47-8461-f2df536053d0.filesusr.com/ugd/4dcf4e_e271b0bfff5140d58db9305309ecd786.pdf?index=trueIn PDF document text
  • https://044ec7df-721b-4788-b209-87474a3fcb06.filesusr.com/ugd/60ffa2_0abae04eac334897a7470618bc7728c6.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/fabc0faa-4b61-4de8-ad16-c9e9896f5f1b/the_maze_runner_movie_synopsis.pdfIn PDF document text
  • https://6ec3981f-6443-463b-a164-91fc69f101d9.filesusr.com/ugd/7603ae_3654963dfc6a4e6a85cd587a32c00189.pdf?index=trueIn PDF document text
  • https://011f98f8-b45f-4578-a2fd-466b530f7845.filesusr.com/ugd/74e905_0d7194d1596f463795a63ab17281f504.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/9955b10f-a9f6-452b-8955-4f65f5f5d4e6/troy_bilt_edger_blade_change.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.