Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://gimoguvi.ru/strik?utm_term=pandigital+digital+photo+frame PDF link annotation

  • https://cdn.sqhk.co/samigimas/get8iiH/introductions_examples_of_report.pdfIn PDF document text
  • http://runexutofo.iblogger.org/les_4_accords_toltques_rsum.pdfIn PDF document text
  • https://cdn.sqhk.co/kokademesuz/jj0RI8c/sodowe.pdfIn PDF document text
  • http://fapumew.22web.org/ergometer_trainingsplan.pdfIn PDF document text
  • http://lozejokewoj.22web.org/a_user_s_guide_to_capitalism_and_schizophrenia.pdfIn PDF document text
  • https://cdn.sqhk.co/bebomopakax/l16jgQt/bombastic_person_in_a_sentence.pdfIn PDF document text
  • https://cdn.sqhk.co/nakunadubux/djjOvgf/certified_dental_assistant_salary_ny.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/13b844d1-40f3-4fa5-b5a3-0e473ba9a5a1/how_do_i_return_my_verizon_router.pdfIn PDF document text
  • https://8eefcaf3-52f5-4123-8be5-b1f0aaeea45e.filesusr.com/ugd/1d3654_09782cfe8f764d06925a0d760db46470.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/532f0f95-29a2-4d96-bcf8-cef88a61a928/repijozilivef.pdfIn PDF document text
  • http://gorosojipi.rf.gd/hp_officejet_7610_print_head_price_in_india.pdfIn PDF document text
  • http://tebuwibuweni.rf.gd/the_first_estate_was_composed_of.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/022e9d0e-615c-4328-a0ea-8a9b893abf3e/17257674752.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a59b6dee-73e5-459d-8891-efa19ecd08c0/staples_mailmate_m7_manual.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6c0bb9f5-68dd-46bb-a958-58d4235a3b61/21560236789.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/288e0a8c-1907-48b7-881e-3efe301f795f/74459387094.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5527436d-3c66-4e8e-8a45-21be314e1c32/94361827534.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/93ae18f7-3dbb-4533-aa24-e35dd79b65f7/590292202.pdfIn PDF document text
  • https://042e50b4-45d0-4577-915a-c14d43ab21ad.filesusr.com/ugd/18f527_65112daf077a4dee93dcd5aa85b75f78.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/4fe1bd27-04cd-4480-a19a-13bf6faccb7a/45128205598.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b3de4bfe-37f6-4394-8f00-24a79381d783/noxojakoro.pdfIn PDF document text
  • https://08c3cc13-1ce0-4add-927e-a3aed263473e.filesusr.com/ugd/ccf397_3e19b8c1d3a2444a97f60a3e4a0f135f.pdf?index=trueIn PDF document text
  • https://3b0fe5ff-7f86-489c-8138-fc984e51136c.filesusr.com/ugd/bfd78a_a2e6e97521f24aceb65cb14ff1c0303b.pdf?index=trueIn PDF document text
  • https://d451e762-8e00-4155-9971-9512d28d2528.filesusr.com/ugd/b52961_22ab75a5806648458e9094ee8e4987c9.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.