Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://baarspo.ru/strik?utm_term=how+to+get+splat+hair+dye+out PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4451227/normal_6060666461261.pdfIn PDF document text
  • https://cdn.sqhk.co/xezojutatow/hg89igz/flat_value_proposition_canvas_powerpoint_template.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4425230/normal_603e665c72c9a.pdfIn PDF document text
  • https://cdn.sqhk.co/kizafizutuw/igWKjhg/83350770929.pdfIn PDF document text
  • https://cdn.sqhk.co/wizokawoxo/a0hfwhg/crushing_ice_cubes_in_blender.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4483587/normal_60251e9380330.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://6f672a44-e16c-4921-a0f1-e3781c0647c5.filesusr.com/ugd/bda22a_abe71319f1434c488e1a3cdcc66c5434.pdf?index=trueIn PDF document text
  • http://ruxezila.epizy.com/jcpenney_sewing_machine_6925.pdfIn PDF document text
  • https://502f924d-676a-41b3-8220-87c01882f600.filesusr.com/ugd/5a20bb_106be20c902b4f1281e9b6e255d4c30e.pdf?index=trueIn PDF document text
  • https://6f4861c6-cdf0-4a5f-ba2d-f9c5e5bfbee6.filesusr.com/ugd/77941b_a9e603764fa848dfa5d3b9b76aa401c0.pdf?index=trueIn PDF document text
  • https://8acf0fc4-2da8-4686-9788-d7840b5449fc.filesusr.com/ugd/fab691_90b39fc14369446c895254a542d0bffa.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/54acf068-7c7d-4a62-8072-c0c2f068d4fe/lycoming_o_360_a3a_parts_catalog.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/89d6fae5-67d3-4fca-abff-2a7323cd05a5/who_does_china_give_foreign_aid_to.pdfIn PDF document text
  • https://c7972686-9310-4d97-8ac3-15e828887225.filesusr.com/ugd/8a419d_a9d98fed79fd4d1691330fb4f1df52eb.pdf?index=trueIn PDF document text
  • https://a581e706-3bf6-41fb-8978-ad4d4077590d.filesusr.com/ugd/afbe6b_f565ee32d974444db107ed4f10c79a2c.pdf?index=trueIn PDF document text
  • http://wupafar.rf.gd/13839913811.pdfIn PDF document text
  • https://14535e1a-360a-4d01-a655-fa33e115c80e.filesusr.com/ugd/b222ea_0cf7db5a713c40bb914cb4b3da3ddcd7.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/442f191d-3319-4863-a81e-2fe3f81a9abe/kumimusebarokat.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/23684f3c-0e65-4838-b196-43a7bf4a3c62/dell_inspiron_3520_battery_price_in_india.pdfIn PDF document text
  • https://ae8c1479-5121-4009-b0ed-8259dbb1205b.filesusr.com/ugd/0aff45_944e96f08a71428f8877ba1562e01505.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/11fa5d1b-0370-4e55-97d0-5112cdda279f/yamaha_mg124cx_stereo_mixer_with_effects.pdfIn PDF document text
  • http://wolilawobo.epizy.com/pavenuvawefiviv.pdfIn PDF document text
  • http://mibelajute.epizy.com/how_much_does_a_general_dentist_make_in_new_york.pdfIn PDF document text
  • https://2a04f01a-7147-4793-98aa-b59dc93e6f96.filesusr.com/ugd/efcdeb_ce404313edca441f9478af3c4f8cc705.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.