Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://bologen.ru/award?keyword=english+phonetic+transcription+pdf PDF link annotation

  • https://zopivorideruv.weebly.com/uploads/1/3/3/9/133997575/5301494.pdfIn PDF document text
  • https://rigonabex.weebly.com/uploads/1/3/1/4/131483185/siwoz.pdfIn PDF document text
  • https://zatozidebowetam.weebly.com/uploads/1/3/1/3/131398213/tovaxuvowisevonit.pdfIn PDF document text
  • https://xorizelipuv.weebly.com/uploads/1/3/1/6/131637744/zapobamozonudufos.pdfIn PDF document text
  • https://xidazujagavoza.weebly.com/uploads/1/3/1/4/131453269/9091851.pdfIn PDF document text
  • https://lerexujirizafet.weebly.com/uploads/1/3/4/3/134344290/jalibusoxa.pdfIn PDF document text
  • https://xufizuwerab.weebly.com/uploads/1/3/0/7/130738786/1948418.pdfIn PDF document text
  • https://rimuzomidaz.weebly.com/uploads/1/3/4/3/134353295/bofisopivupelex.pdfIn PDF document text
  • https://wovikuzejujitij.weebly.com/uploads/1/3/4/5/134506660/jozasuxowe.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/0ba12b02-fbed-4be6-ba08-1adaee7b8830/what_blades_for_black_and_decker_jigsaw.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7a8ffe88-b825-4a41-a274-cf1a84604bd6/vurigomabajexosinuwuv.pdfIn PDF document text
  • https://76bf42c0-7447-45ed-8dd3-33f9786ae3ae.filesusr.com/ugd/ba2c19_8443e598b4404cb1b01d73b27f2ff091.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/c27ec466-b6ff-4c85-b26d-eef839da2fa4/xuzudurexesa.pdfIn PDF document text
  • https://35479656-6a94-44d6-ac55-da507c14a2ae.filesusr.com/ugd/d68318_0df5dcfdfa0e4d539435cba1239a6d08.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/e63d964b-91e2-4b8f-9226-7300bfde6778/how_to_use_schumacher_instant_power_battery_charger.pdfIn PDF document text
  • https://5f90d536-2a72-4461-adff-280afd3056cb.filesusr.com/ugd/27c394_eaab6741aa6544e0b653b25eac202695.pdf?index=trueIn PDF document text
  • https://df4002df-ed14-466c-b758-10ced248c840.filesusr.com/ugd/3b03e6_b326830140594be398958dc1e1a03751.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/3dad31a0-7b42-483b-a4a5-d9f7d5964343/13871717015.pdfIn PDF document text
  • https://1ceef7f3-d523-4f80-a0a4-3aed54d3d17a.filesusr.com/ugd/48841a_e5ffbb2982d5418abcb9031e7490ce6e.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/522b4023-113d-4359-a8d2-6a4ca7c02293/dirty_riddles_with_answers_in_spanish.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c8500c7e-0a4e-48d1-9560-3d8bc8869053/54271773029.pdfIn PDF document text
  • https://75e6d08a-b14f-4c2c-bd4e-3e6431d9d11c.filesusr.com/ugd/497a87_15ef8ed6873c4828824f801cd5caabad.pdf?index=trueIn PDF document text
  • https://e2604e0b-f95a-4acb-b53f-a7db3827b2a1.filesusr.com/ugd/225520_f7589ef50dd14c3f8e1e7d3551725bf1.pdf?index=trueIn PDF document text
  • https://c370dac7-4848-4fa0-a6df-94361299e8ba.filesusr.com/ugd/fa6303_66abae2a7a524baa88c6735b57325568.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/99e83622-ab1a-40e0-95d2-d9a9b7e27612/nail_salons_open_sunday_near_me.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e49f77bc-e451-43b5-87e7-d8e2c87a27c0/95974940388.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c1e4dc8a-1cf7-4940-ad01-c1e907846816/nixukutubelumezino.pdfIn PDF document text
  • https://f2d828cf-06d9-46ea-85af-d88b0bc20d44.filesusr.com/ugd/501a20_4a3e80b29dc649aea5de77617f6c6b57.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.