Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://bologen.ru/strik?utm_term=installing+bosch+500+series+dishwasher PDF link annotation

  • http://novugatep.22web.org/25010631212.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366044/normal_6020a7599a3b2.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4423757/normal_601954a477f76.pdfIn PDF document text
  • http://zirisumiwuxi.iblogger.org/android_chrome_browser_github.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4417037/normal_5fd9dbdb7e87e.pdfIn PDF document text
  • http://dubiniba.iblogger.org/physics_today_mtg.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4366632/normal_5fc66440cd65e.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/25d4b892-e776-445e-8f32-16eb5d2b0159/kelejaradolonabexomoxediv.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f55ea0db-8738-4941-9bfa-8da1e1075e14/el_ser_y_la_nada_completo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/57f36d0b-5c38-4585-b83e-17fed895b268/clear_skin_forever_book_free_download.pdfIn PDF document text
  • https://e26dc784-fa46-4601-9f6d-57686faaf216.filesusr.com/ugd/c66525_1cd14eec8776474ba9ca30637b9fa86c.pdf?index=trueIn PDF document text
  • https://07f52280-50dc-49c2-beec-a2e30bf849d0.filesusr.com/ugd/7b8f90_f827b5c46da446959f048a61f297cf6c.pdf?index=trueIn PDF document text
  • https://502f924d-676a-41b3-8220-87c01882f600.filesusr.com/ugd/5a20bb_376aac6b7127437ca63e8be43bb1bd52.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/23edd327-d890-4c92-85e7-c3c7565240ac/92569705904.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fbcfc633-d24b-4674-ac16-b8551871c8f7/11989863282.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/80aa4a13-ca64-4c5f-be64-cc642e004fd9/books_of_the_bible_song_words.pdfIn PDF document text
  • https://71347f20-8353-4153-bebc-dd2a28b3a5cf.filesusr.com/ugd/a382ee_5588393e492446978b78bef9ce3b8b97.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/a0b3fd53-91b8-4688-8b47-455b39b28f41/harley_davidson_maintenance_schedule_checklist.pdfIn PDF document text
  • https://e082b6be-64c0-45f6-a8ff-82b9c6f476f0.filesusr.com/ugd/1479de_531b9cb631d9491489adeb6bbfd00061.pdf?index=trueIn PDF document text
  • https://e6e31949-ba74-43ae-8e0c-2243355e89fd.filesusr.com/ugd/69e259_eb677aeda36b4144aa5d42efee5a7098.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/59cdedbe-f0b7-49ea-82ba-4c8c7090a1f7/dixoxizigebogususemitifa.pdfIn PDF document text
  • https://19f621d4-ab03-49b5-bf1d-c78de40104d4.filesusr.com/ugd/bc84a3_1f2daaffe4db4d7e94bfc90c4237ad44.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.