Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://xajibur.ru/strik?utm_term=how+do+you+do+needle+maintenance+on+a+keurig+coffee+pot PDF link annotation

  • https://cdn.sqhk.co/kigimole/tdcBhgu/7207699996.pdfIn PDF document text
  • https://cdn.sqhk.co/kagumuzom/RNryhbG/93564169890.pdfIn PDF document text
  • https://cdn.sqhk.co/viposaxa/gfiezFL/shadow_fight_3_pc_hack.pdfIn PDF document text
  • https://cdn.sqhk.co/sarowojep/fXgcteh/2020_football_college_rankings.pdfIn PDF document text
  • https://cdn.sqhk.co/wanoposuj/bficjaU/zombie_escape_ship_tampa_fl.pdfIn PDF document text
  • https://cdn.sqhk.co/matajikiwov/Yhfjghf/best_video_status_application.pdfIn PDF document text
  • https://cdn.sqhk.co/noxomosanena/iijhbjd/14248819889.pdfIn PDF document text
  • https://cdn.sqhk.co/zijopenuxafi/Ajcij6o/simcity_buildit_pc_download.pdfIn PDF document text
  • https://cdn.sqhk.co/bijilixiger/GbAlzij/classical_piano_pieces_in_c_major.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://6d5fec37-5936-4ae8-8938-03a86e982f09.filesusr.com/ugd/d4da64_f19f8cf7380e43b7a1c2b7a3c3ad440f.pdf?index=trueIn PDF document text
  • https://0f642c0d-c9ff-444d-8de1-b0511ceb41c3.filesusr.com/ugd/165585_4f8ae81bbd60470d9a9ef604431cdfa0.pdf?index=trueIn PDF document text
  • https://59bb578d-b312-442a-858b-1a1a54b18a6c.filesusr.com/ugd/c79b1c_8d94b5a0ede84f0fb8ac0cb1013acd79.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/12a39921-ab38-4f62-96eb-5472e91821ed/rowuwejema.pdfIn PDF document text
  • https://9334512a-4df1-45dc-8804-f0fa1d9e2a3d.filesusr.com/ugd/9466eb_f6eef22f5d4c4b7d8da67d98ef768b0f.pdf?index=trueIn PDF document text
  • https://13a2bf7a-7930-4518-a7e6-737bf3c0aa4f.filesusr.com/ugd/f5c1a0_da4b2b422a634bfb9e3e240c04294237.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/8e5e6ac1-b8c3-4f60-b97f-2e8cec62958f/how_to_reprogram_a_marantec_keypad.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0297b715-8ab8-4614-8c93-add608e2d1bb/how_to_fix_samsung_tablet_wifi_wont_turn_on.pdfIn PDF document text
  • https://29c5b005-6627-40e3-9da1-9f9d3dbc34dc.filesusr.com/ugd/7ad284_42956f7cab334ad99fbd5a56a610ba24.pdf?index=trueIn PDF document text
  • https://93641f3c-03d3-4c8c-b6db-0fd9bfabe798.filesusr.com/ugd/384ca7_79b2f859b28241028ba8765f7e992e6b.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/c72c1afd-4ab0-4c2a-be89-9426016db8d7/48201419884.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f8d6b10f-a83f-4a52-82f1-5811d513f7fc/verbos_regulares_e_irregulares_en_ingles_pasado_y_presente_simple.pdfIn PDF document text
  • https://3e1af3dc-cf37-4f58-935d-0a6065bc5ce9.filesusr.com/ugd/3ca236_c534f8b4a6624406b3af75214f584c92.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/261d47a4-1c9b-4587-8d37-98a635eac904/mixer_yamaha_mg24_14fx.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/71f2f53f-69ef-415f-981f-01562b847ea3/cuisinart_food_processor_dlc-7_parts.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.