Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Urgency / deadline lure low SE_URGENCY_LURE
  Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://botokaw.ru/strik?utm_term=bbg+free+month PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4378386/normal_6036357dba777.pdfIn PDF document text
  • https://cdn.sqhk.co/rapaxino/VKgfhfU/72358403544.pdfIn PDF document text
  • http://mscredit.info/verizon_remote_not_working_with_cable_boxop5zf.pdfIn PDF document text
  • http://fruitik.space/53365895814whnm5.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4375708/normal_60158188beeed.pdfIn PDF document text
  • https://cdn.sqhk.co/dezorevukor/ii19eid/56977887288.pdfIn PDF document text
  • http://sodahq.club/singer_4411_vs_4423hd1fg.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4388620/normal_5ffddb9f6c981.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4377717/normal_600bbd0c4103c.pdfIn PDF document text
  • http://apkweb.net/3786824045dcgbp.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4487206/normal_5ffc31e2ec72b.pdfIn PDF document text
  • https://cdn.sqhk.co/pesarukogi/fv5IWhe/biomes_in_southern_africa.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/a5da68fa-5cba-4b0d-9472-914b381ec721/bavex.pdfIn PDF document text
  • https://d67926d6-99fe-48a4-938f-95006fdf2de6.filesusr.com/ugd/21d82e_c3dd69852f1d47c98642bf317dafe0ef.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/5ea3cf23-5c1b-4ee4-9914-5ed85aa28196/zoxejinitomewizivegif.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/63225838-1c1e-4ff2-b8ab-917202ec2e2f/gonufujevubun.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b97ea347-ba45-46b5-90a4-4ccc6140dc42/lubopisogosu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f5c820e3-13f8-4a92-bf8c-3f5f3d37dea5/29878056964.pdfIn PDF document text
  • https://f538c46d-6aff-4997-95da-320e40b30403.filesusr.com/ugd/262ba4_88a314aae64d43599c7b6de51f107194.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/52f87f21-9c14-4df3-9ed3-a751977e378a/nigikisogosoneluwigabanom.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8d68f01b-09f3-4213-b57b-a1b43b5ae815/axial_scx10_iii_kit_unboxing.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/41e82808-c5c1-4a78-93ec-aa57dc729420/what_size_tires_does_a_2015_chevy_equinox_have.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/87cf0751-7614-4c1a-8a7f-b718fda98b57/godumojejuxipole.pdfIn PDF document text
  • https://7ef5d8b8-74ac-4e0a-b0a0-fa61ca6462a8.filesusr.com/ugd/23e9be_f1313b11a62e46deb2184cfcd2cf870e.pdf?index=trueIn PDF document text
  • https://502f924d-676a-41b3-8220-87c01882f600.filesusr.com/ugd/5a20bb_7b89769d80e54e0ea498190e1995819b.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.