Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://xezojetit.ru/strik?utm_term=what+really+happened+to+hae+min+lee+reddit PDF link annotation

  • https://static.s123-cdn-static.com/uploads/4370541/normal_5fc6b64161551.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366029/normal_60171caf2f5a1.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4414678/normal_5feb474347535.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4471096/normal_6016cb04204b3.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4401555/normal_5fd6d8ef7368e.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://9eaa565e-fb97-40b4-b096-d6760803f699.filesusr.com/ugd/55e2c6_bb70e153a1394cf38309f08e00e1d2e0.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/ee60cce1-d77b-475e-9679-1c8eb9e245df/how_does_a_float_sensor_work.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a6b01d89-bb45-499d-bb63-46c765d3cc5d/xuwumozuwefixevapegizuram.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/63db6c8e-0419-4858-85ab-772d85edbd0a/81547286238.pdfIn PDF document text
  • https://35479656-6a94-44d6-ac55-da507c14a2ae.filesusr.com/ugd/d68318_cde27e3573d243e3a1a485174649c296.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/fb5e24ed-5efe-41b6-85f2-af04a805985b/kudevisazelopijuje.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/61a67d8e-3a18-4b5a-b2ff-9ef8ab4ce72b/11142248538.pdfIn PDF document text
  • https://882e4f53-a7e1-4d4a-89e8-a6e6d9f9b805.filesusr.com/ugd/9a13d2_ac6d8a4fade240228940edd1e098b408.pdf?index=trueIn PDF document text
  • https://66f9c2bc-82a6-463d-9ccd-9c94d3d8805e.filesusr.com/ugd/b361c6_c1b81c815d7749a197a60ed1c1452ede.pdf?index=trueIn PDF document text
  • https://cb47f074-0476-4434-b381-5672a365cab8.filesusr.com/ugd/c46c8a_6e4db161a6684142ae18243507a8302e.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/ed4fbf48-57ab-4e5a-8759-da510f26c21e/romance_of_the_three_kingdoms_xiv_ps4_review.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b84e8d63-9038-47c4-84de-42c35101bdce/how_to_use_fluke_networks_microscanner2.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/54950742-8663-4096-bfb7-9bd327e0c4da/player_handbook_2.pdfIn PDF document text
  • https://fa90eb46-aa9b-4fd1-a2e8-e903ec8e50a4.filesusr.com/ugd/575fb0_62fc890a30c141b3adba66b5dc58e442.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/b03b7c04-3bce-4939-9dde-2605032edc85/fisolipufezobuxu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/823bb525-74b7-4d08-a971-7bddbd4dd143/ruketuzobuzaxogo.pdfIn PDF document text
  • https://70fbc5f3-53e4-4072-9ff7-a5862d19847b.filesusr.com/ugd/bb3bf9_0c8bf54e7c6a407c9df5df23fd33af5d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/13851e74-e8d2-4edf-87a8-43b374557d51/time_enough_for_love_heinlein_review.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.