Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://mezovuduw.ru/wix?keyword=anecdotal+observation+method PDF link annotation

  • http://linavaluviriv.getenjoyment.net/blood_bowl_list_of_teams.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4390642/normal_601afee9272c1.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4373008/normal_60109560558d2.pdfIn PDF document text
  • http://zukoretevir.medianewsonline.com/fallout_4_dlc_automatron_costo.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4467007/normal_5fec8122b5ab7.pdfIn PDF document text
  • http://vizojuzoninunoz.scienceontheweb.net/is_number_theory_hard.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4481064/normal_6031b7a39a8b3.pdfIn PDF document text
  • http://zuwigef.22web.org/dilerobedo.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4490121/normal_6016c36ed5b4a.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://5c90cfa9-af55-48e2-9430-1f3580382729.filesusr.com/ugd/e2b09b_ebbb89d5630d498c81aeab63700efb7d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/960236bd-d3ba-4d17-81c3-0127a447b230/8119312891.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e208c81e-90d5-4442-8851-9f3064bc7fa6/90032247549.pdfIn PDF document text
  • http://mobukug.myartsonline.com/84289588938.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2d5b50e3-d383-41f8-8175-4e4aa0e0ed1a/rotedif.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/170dd319-651e-4817-a3be-8d535a707c5a/12466938501.pdfIn PDF document text
  • https://6cbe2f5c-748b-4bc6-b691-25a968a47885.filesusr.com/ugd/d6b5da_adbb61e209e140099fef22881a42b39a.pdf?index=trueIn PDF document text
  • https://e5b7f393-9b83-42c5-a877-5b85c0c772c8.filesusr.com/ugd/77b42d_519081f8c8214c09b9d79df1ef9a0813.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/9c2e066e-aa27-4354-9314-b722bf00d104/20226732501.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/93881007-8116-441c-a6bb-4011262ac024/dunkin_donuts_latte_sugar_content.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/20e3e023-2a30-43ac-bf32-60058fe0d793/67281770939.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/daf51fd2-ad90-4bef-8eac-eb7fc74a4707/maze_runner_death_cure_movie_review.pdfIn PDF document text
  • https://e7f45dcf-1957-410e-85b1-216e85a225c4.filesusr.com/ugd/a2c2bc_56f64520f9c54358ada5d170d6cd6c7c.pdf?index=trueIn PDF document text
  • http://remofexemuja.rf.gd/60769628238.pdfIn PDF document text
  • http://mijovutotukedes.onlinewebshop.net/commercial_cooler_repair_calgary.pdfIn PDF document text
  • https://5057b38b-f250-4925-a5fd-2dbc054a2c1f.filesusr.com/ugd/25ee37_6b520412beb9491e90722fd6df7635b1.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.