Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://mezovuduw.ru/123?utm_term=strategic+planning+process+template PDF link annotation

  • http://faceit.su/reraloravumolanasedorgn422.pdfIn PDF document text
  • https://cdn.sqhk.co/simikitivo/AjbXOX8/morgz_24_hour_pause_challenge.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4526930/normal_6031014f0fc2d.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4404103/normal_6040be7154fbe.pdfIn PDF document text
  • https://medijomozu.weebly.com/uploads/1/3/0/7/130775841/1227451.pdfIn PDF document text
  • http://romeital.space/rogativamilokaxodax7zqnk.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4388067/normal_5fe308d036f7a.pdfIn PDF document text
  • https://bikezurikol.weebly.com/uploads/1/3/4/6/134612173/2258512.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4458622/normal_5ff68ea898435.pdfIn PDF document text
  • http://idealicaitaly.site/toyota_camry_hybrid_on_road_price_in_india_201990noj.pdfIn PDF document text
  • https://cdn.sqhk.co/fuvebopeweb/jbRif2g/suwuxazuferojox.pdfIn PDF document text
  • http://servicesforsupport.com/jixaserofefetipola6e0k.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4426073/normal_5fcc25a512c38.pdfIn PDF document text
  • http://present-mag.ru/dd_3.5_sorcerer_only_spellsc0bpo.pdfIn PDF document text
  • https://cdn.sqhk.co/dogojaseziwo/bRh0hi9/nostalgia_definition_in_spanish.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://e49cd12a-7e53-4a25-9f98-ae37b5ff2e44.filesusr.com/ugd/35dc59_5235f6278b694a899e0f32c739117cca.pdf?index=trueIn PDF document text
  • https://9eb5ee95-128e-4115-bcd6-d8db8525ce49.filesusr.com/ugd/9904c2_be50e2a0a7f74532a373bb20b1343075.pdf?index=trueIn PDF document text
  • https://26c1613e-5d28-4fa3-89cb-3d2c9ab59faf.filesusr.com/ugd/fe83c3_ae1b7433718144fc903e7ff892cbd0b2.pdf?index=trueIn PDF document text
  • https://9169454a-6e45-4b39-89c4-5cd9bf0a6084.filesusr.com/ugd/32fbc8_f9b65b1c79d1445fb765c95080cb5a2e.pdf?index=trueIn PDF document text
  • https://c63ca81c-6df4-4ec3-bc2e-8508f29a6879.filesusr.com/ugd/d48fe3_080e99fa82354fb9abad011251f88cb5.pdf?index=trueIn PDF document text
  • https://680e7e7f-99bb-4309-8a01-ecc910dc7690.filesusr.com/ugd/717a42_b20aa5f8be894e6a954181955667392e.pdf?index=trueIn PDF document text
  • https://f8071fb1-33dc-4bb9-9fe9-292e0ca0d861.filesusr.com/ugd/253000_58f40f5e1b8243f1a8b69680a7d90197.pdf?index=trueIn PDF document text
  • https://04934832-22f3-474e-96de-b9d593e92251.filesusr.com/ugd/f390e7_4734bd15cc4146fd8a3b4291687bf912.pdf?index=trueIn PDF document text
  • https://f3dbd103-cf2f-44fc-b0ad-c9004dc38af2.filesusr.com/ugd/1f2646_f90184892165437183df1705a32c701e.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.