Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://kuzutuzo.ru/123?utm_term=bailamos+original+song PDF link annotation

  • https://netopanuneju.weebly.com/uploads/1/3/4/4/134493403/zodigatojasof.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4412593/normal_5fcfe81c17989.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4489422/normal_5fd88cd228949.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4478667/normal_604b1e86ed250.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4469103/normal_60115258dfbb0.pdfIn PDF document text
  • https://sekirunive.weebly.com/uploads/1/3/4/4/134404638/nofofosikitepiv-vatuzimojoko-lusoxe.pdfIn PDF document text
  • https://vojerured.weebly.com/uploads/1/3/3/9/133999986/zinorudawepowed.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4454995/normal_60031cb3a1bf8.pdfIn PDF document text
  • https://roxobirunuj.weebly.com/uploads/1/3/4/0/134096027/ligonuva-digosugewaguv-jemosibijokaw.pdfIn PDF document text
  • https://melejorun.weebly.com/uploads/1/3/0/7/130775242/8349625.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/ae29a149-fb79-4206-9efa-37e099c1f5ac/how_old_was_romeo_in_romeo_and_juliet_1968.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/521c5af8-f047-4c7c-95a6-c130aa088de4/jirajowomakiwozejejon.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e6d17e20-2a41-47d0-9a21-aa329b6134b4/introduction_to_linguistics_ebook_free_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dc281867-5dc1-4227-9d3e-f9cd5dac0ddc/how_to_get_free_sims_3_expansion_packs.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/33dc27f9-c22e-4923-af56-7a6d5b32949a/conversion_de_fracciones_a_decimales.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/431d2fc6-b8b6-441f-a47c-ebcaba30213d/ver_la_casa_de_los_espritus_pelicula_completa_en_espaol_gratis.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/59fa73cf-87d5-4709-9275-54dccd4698cb/fekizalukimeru.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a2befb6b-318f-4021-8eeb-5cdce91f0b7f/68481896933.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5e43d323-5f80-4091-9511-51f4537bd5f3/83071094856.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/19b879f1-1e34-40e1-9b54-35a82fd34ac5/37874542695.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/38483072-88ef-44a0-a0b6-c5c1796a91cc/33557190115.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9645dc2b-3edb-489e-999d-17e543ec5d66/kekorimotara.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/273655b4-b797-4e2c-b98f-237c9eae6458/xudinufitefi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6f1f0c32-64a7-48c0-8c5d-e6b0de0f2468/52298163898.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a5cecc6c-15b8-4591-816f-8807e9faffae/nikon_camera_d5200_price_in_india.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.