Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://crysiq.ru/pbw?utm_term=jurassic+world+evolution+dino+compatibility+chart PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4382631/normal_5fdb0f96c52fe.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4476936/normal_5fdeea5a85be0.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4481400/normal_5fced92ceb5fe.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4408873/normal_5fffd3486987d.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/f2518d23-c722-48b0-9598-c963ef6fd2a1/fujik.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e853507d-996f-48fc-a244-bf0b9420a31c/elements_of_system_approach_in_education.pdfIn PDF document text
  • http://kejuziz.pbworks.com/f/38924317655.pdfIn PDF document text
  • http://fajopab.pbworks.com/f/86225786888.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cca3d7fc-be18-4abc-b2ae-f58b8a2dcfc7/can_i_download_unreal_engine_4.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9eaa5102-e66f-4ee8-ada4-faa2eb49b38f/labialization_phonological_process_definition.pdfIn PDF document text
  • http://sutodoromar.pbworks.com/f/vidmate_app_free_download_old_version_2.22.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4c2c8d3d-f17b-49e8-a14f-da0986c85db5/are_jeep_libertys_reliable_cars.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/607275fa-7866-4c94-b240-f1ac2290d0cb/free_download_mediatek_usb_vcom_android_drivers_windows_7_64_bit.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/106d2a74-4c54-4279-b9b4-0241726c2fd2/englander_wood_burning_stove_reviews.pdfIn PDF document text
  • http://ravowibosu.pbworks.com/w/file/fetch/144444024/26358486170.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2eb9cacb-3124-42b8-a5cb-5fa78b613409/zuputa.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6de2bccd-671c-4166-b18b-1e618a269eb7/panasonic_telephone_battery_replacement.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e5412f15-3d41-4f5d-969e-aa323f5bb444/gmat_official_guide_2019_vs_2020.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/29d38483-c605-4eb2-b502-24523d99a176/vazivavoniripumipe.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5d24039a-ff7b-4cae-aa21-712e4823a291/30979612617.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/40afbd82-cf42-4979-8e5f-235e71f4295d/scale_drawing_math.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8d973087-da24-4897-93b7-485ecf575af0/basic_english_learning.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c631767c-3806-4418-8730-b95735c7268d/the_divine_comedy_free_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/51a20fb0-2c5f-4c4c-91cf-2dc8a2b87114/how_to_do_ninjutsu_like_naruto.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5412da93-dc84-4712-881d-3959781cebea/sat_subject_international_test_dates.pdfIn PDF document text
  • http://detomipipu.pbworks.com/f/sasefuxixopowumizovukara.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • https://savannah.gnu.org/projects/freefont/In PDF document text
  • http://www.gnu.org/licenses/In PDF document text
  • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.