Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://bologen.ru/strik?utm_term=how+long+average+book PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4365567/normal_5fd2a7430d0e6.pdfIn PDF document text
  • http://milanomodaitaly.site/google_tricks_thanos_wizard_of_ozsgfdn.pdfIn PDF document text
  • http://varistop.site/kindle_fire_instructions_for_use8zhes.pdfIn PDF document text
  • http://simcars.ru/991411157235dlqa.pdfIn PDF document text
  • https://cdn.sqhk.co/kazaluxi/cjeS6qQ/tunnel_rush_unblocked_games_77_weebly.pdfIn PDF document text
  • https://cdn.sqhk.co/nusuguponu/9WMyORs/vezev.pdfIn PDF document text
  • http://genusadnlo.space/is_logic_a_good_daw39krc.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4413361/normal_602ae028de8a8.pdfIn PDF document text
  • https://cdn.sqhk.co/fufigavaki/fhii7ib/zaxemodigaxixasuvubonisu.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4499636/normal_6019163cd7372.pdfIn PDF document text
  • https://cdn.sqhk.co/xuluriwu/hfgeVgg/292709185.pdfIn PDF document text
  • http://form-lnstagramcopyrightservice.com/41579530669tzc4f.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/benuka/how_to_setup_garage_door_opener_remote.pdfIn PDF document text
  • https://s3.amazonaws.com/varoximu/12107813831.pdfIn PDF document text
  • https://4779f2f8-a33e-4327-9c78-21ee0bcf4620.filesusr.com/ugd/31bf02_fe5f7f96d5b54196a5c5a1602405ff0a.pdf?index=trueIn PDF document text
  • https://0c2a7d7b-be9d-4ef2-a94c-09ca905cc17d.filesusr.com/ugd/7d21c0_48f05be78c224d218a9718296e884f10.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/mawesenasijoser/charmed_season_1_episode_8.pdfIn PDF document text
  • https://s3.amazonaws.com/bejexe/64747121810.pdfIn PDF document text
  • https://s3.amazonaws.com/fisulefajow/76889347383.pdfIn PDF document text
  • https://b8436764-02b3-4471-8711-1e8fed235cf0.filesusr.com/ugd/3b3fbb_5e44259da39f4fdbb25586f2993c0ad9.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.