Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://yafferge.ru/strik?utm_term=pretty+things+guitar+chords+kat+hasty In PDF document text

  • https://cdn.sqhk.co/limiwebu/hhh9V9Q/chilis_to_go_job.pdfIn PDF document text
  • https://cdn.sqhk.co/bulelovuroga/awkjhhf/junikixewaropuravenofogog.pdfIn PDF document text
  • https://cdn.sqhk.co/nuzifixe/cR4Gias/evil_snowman_names.pdfIn PDF document text
  • https://cdn.sqhk.co/widafopaj/gjq0hcK/word_connect_level_151.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://s3.amazonaws.com/jipowumat/gta_5_cheats_pc_free_money.pdfIn PDF document text
  • https://s3.amazonaws.com/nilafafakem/best_overall_bosch_300_series_dishwasher.pdfIn PDF document text
  • https://s3.amazonaws.com/pazatuv/hp_officejet_pro_8620_e-all-in-one_printer_printhead.pdfIn PDF document text
  • https://s3.amazonaws.com/zuxime/78676551948.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f30a87ef-1a07-4d2f-a84e-92c649ecf893/2016_corolla_le_specs.pdfIn PDF document text
  • https://67d298e0-85f4-4ad4-bf36-e1ac857e42fc.filesusr.com/ugd/b6bf5b_417637a7011849cca114d779c82a7e8a.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/16b404c3-92b3-4761-8742-b23c454af0d6/kinetico_water_softener_salty_taste.pdfIn PDF document text
  • https://0e8f88b9-656e-4b05-9cd8-8bd477f85547.filesusr.com/ugd/95b9ea_43b43192cde84e6ba996ef5943bd6bc3.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/tobovunoberiki/mathematics_probability_and_statistics.pdfIn PDF document text
  • https://s3.amazonaws.com/xijalovelokolep/arsenal_vs_burnley_goal_highlight.pdfIn PDF document text
  • https://s3.amazonaws.com/rijaliwiguvex/aramaic_english_new_testament_5th_edition.pdfIn PDF document text
  • https://s3.amazonaws.com/liguwubore/vtech_cs6114-11_dect_6.0_cordless_phone_with_caller-id_black.pdfIn PDF document text
  • https://00c0516a-c822-4344-a779-6f74e039753d.filesusr.com/ugd/9e41f0_83de365aff5843cca96f685d9d6300c8.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/gupawupigawono/abacus_level_6_worksheets.pdfIn PDF document text
  • https://s3.amazonaws.com/wixanarer/red_lace_formal_dresses_australia.pdfIn PDF document text
  • https://s3.amazonaws.com/pezofut/dufusojo.pdfIn PDF document text
  • https://s3.amazonaws.com/mogipegi/langrisser_m_enchant_guide.pdfIn PDF document text
  • https://8a7e94d2-1b07-4399-8a7b-cfebf1eb419e.filesusr.com/ugd/e78b77_81e10e94581e45b4a6730aba00b0ef62.pdf?index=trueIn PDF document text
  • https://17851959-1482-4b49-8222-7b7b0c628459.filesusr.com/ugd/3cb679_05d31a0bfb464d6e9d2fc395bc83f44b.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/pisedij/kashikomarimashita_destiny_answer_facebook.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4152642f-82d7-4b22-b3cc-c704b0f02d5e/a_cuanto_equivale_1.50_metros_en_centimetros.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.