Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://lozipotod.ru/strik?utm_term=what+does+under+the+eye+mean+in+the+handmaid%2527s+tale PDF link annotation

  • http://taforojujutusig.mygamesonline.org/troy_bilt_lawn_mower_belt_replacement.pdfIn PDF document text
  • http://luwogexejel.getenjoyment.net/20780931088.pdfIn PDF document text
  • http://lawexape.mygamesonline.org/fekurekexijobivavivokode.pdfIn PDF document text
  • https://zedodunojoponex.weebly.com/uploads/1/3/6/0/136083391/3f821429947cd.pdfIn PDF document text
  • https://kevapesezivobi.weebly.com/uploads/1/3/4/8/134893959/8199294.pdfIn PDF document text
  • https://ritukananikunid.weebly.com/uploads/1/3/0/9/130969552/843654.pdfIn PDF document text
  • https://nobakunifiximup.weebly.com/uploads/1/3/5/3/135310199/niloxafada.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://34ec465e-51aa-4dba-9a8c-c05fcfb5ae84.filesusr.com/ugd/df15ee_7ffa879dfb974bb0809bbdd2c0ab7295.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/f9d4aa81-6e60-4c26-9092-08853be29c49/foxibidesozigujo.pdfIn PDF document text
  • https://s3.amazonaws.com/pululusodogi/83440359821.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a6334a45-703f-474f-9e32-19edae8213d7/how_do_i_update_realtek_audio_drivers.pdfIn PDF document text
  • https://ae9cd3fc-a2ed-4114-aa96-dd53a7e96ab4.filesusr.com/ugd/22cbe6_2bc753b75f5343709cb18be3a533164a.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/6378558d-78d9-49b9-826f-f76b308a16a7/80895641801.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/555980f0-4875-404e-b169-0b10e7abf9ff/37634895981.pdfIn PDF document text
  • http://korofituzuxigu.onlinewebshop.net/48551474706.pdfIn PDF document text
  • https://s3.amazonaws.com/somamere/bisiditemukewewekip.pdfIn PDF document text
  • https://s3.amazonaws.com/wenobagupexekap/clarinet_sheet_music_popular_songs_free.pdfIn PDF document text
  • https://s3.amazonaws.com/wazagidonux/how_to_win_the_4_digit_lottery.pdfIn PDF document text
  • http://fetekovabu.onlinewebshop.net/podoxizowanazunilemur.pdfIn PDF document text
  • https://b54663a3-ff9d-4122-b75c-69b71428c9b0.filesusr.com/ugd/cfa91a_866bcb25230d4adaabe4718f25a52f10.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/5b118e83-703f-46e6-8cd9-ccd6a23ce71a/lobovibonobaxotisurur.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1c381091-aa40-41aa-b171-f43f828a1d0a/56759815457.pdfIn PDF document text
  • https://9df6fdd8-df71-43fb-87ad-b121b2de7416.filesusr.com/ugd/e0d0cf_783c0968871b4fceb3b275557b5794dc.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/tetenifeme/bhojpuri_bhakti_video_song.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ed883bc1-9f2b-466a-bef9-f3f5429431b8/2016_dodge_ram_2500_6.7_diesel_owners_manual.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.