Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://golowaki.ru/strik?utm_term=domino%2527s+pizza+garlic+dipping+sauce+recipe PDF link annotation

  • https://cdn.sqhk.co/kinanekoxo/eX8No85/49642042146.pdfIn PDF document text
  • https://wodikaludesavoz.weebly.com/uploads/1/3/1/4/131453455/nesowekovepovojojo.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4489257/normal_601cffad292cf.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4469847/normal_603f091ec1c2d.pdfIn PDF document text
  • https://lujegasot.weebly.com/uploads/1/3/0/9/130969173/tekubidagi-gugepe.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4451752/normal_601e2b7c6c354.pdfIn PDF document text
  • https://cdn.sqhk.co/xivomojuf/xijvfjf/takeout_near_me_open_now.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4485943/normal_5fdc50f920ccd.pdfIn PDF document text
  • https://cdn.sqhk.co/zuxafopagad/H7Zjbhg/ruberenefozuvef.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4453551/normal_5fc5ab6b194fd.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4385235/normal_5fd7f16aec79d.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4411229/normal_604ee92a568a2.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4383807/normal_5fdaf0e03bba6.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4458163/normal_5fd3c87aea693.pdfIn PDF document text
  • https://cdn.sqhk.co/juwasakekeja/FjexXCl/nimamedefemodi.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4455884/normal_6006b01a9dd06.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://c3438639-6a75-4920-aa4f-d1e0b619354f.filesusr.com/ugd/3be3a7_56251cc4058244499d3cd02869add937.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/4220533d-39fc-4bec-aa19-1483e14a8337/what_is_climate_change_definition.pdfIn PDF document text
  • https://59cf682b-6680-4a08-8b8d-0472bab64ef7.filesusr.com/ugd/d7d6cd_eee09c9479f947e0b91d6098215cd329.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/d84715ed-0d2e-4c4b-a248-7ab4e22b2604/harley_davidson_owners_manual.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/aa629e52-35eb-4c31-b862-dd89b6cb1d75/43689517908.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/eacb490b-4a06-498b-9a1b-aed354bd467c/hp_printer_c4580_print_cartridge_missing_or_not_detected.pdfIn PDF document text
  • https://ecc4b077-82d2-4cf1-ad45-1e482560a890.filesusr.com/ugd/5d7ac5_45c523ba8feb41b095fcb82ab09f0f77.pdf?index=trueIn PDF document text
  • https://f77c8dad-41d7-4a8f-8d8d-c05149a3a236.filesusr.com/ugd/36d413_5a44532c1be845a89f9db41ac5c158d4.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/f82bc75e-cc9a-4aac-9dcd-1464c3b90f06/flash_player_alternative_for_chrome.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.