Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ponafet.ru/strik?utm_term=playboy+song+mp3+download+mr+jatt PDF link annotation

  • http://romotogez.22web.org/video_converter_for_android_2._3._5.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369306/normal_603331cd0fbc4.pdfIn PDF document text
  • http://bofesota.66ghz.com/58587461985.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4496165/normal_606a3cb3b7706.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4472484/normal_604ab8aad9389.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4390095/normal_5fc6abe45353b.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4466675/normal_5fd1751b29d58.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://e064a861-6c7b-46af-b67a-66be1f32d776.filesusr.com/ugd/ec3e4b_24f88e52d451432685f40190271f8123.pdf?index=trueIn PDF document text
  • https://6f847715-c85a-45d9-ae5c-7c68cc800588.filesusr.com/ugd/6e100b_80703a1b328a426180f09dffbb88f0cf.pdf?index=trueIn PDF document text
  • https://05282879-aed3-4f16-ac14-d534add4d4bd.filesusr.com/ugd/0f8b7c_454fa67ee8704e86b454317b0b36abc6.pdf?index=trueIn PDF document text
  • https://5b2b9875-3923-4577-9ef6-0527498c95e7.filesusr.com/ugd/4e6dd5_951121f69ecb40e597b7eb069661adb8.pdf?index=trueIn PDF document text
  • https://fc060a1e-8c1d-4b7d-bafd-75f79d4c6355.filesusr.com/ugd/c0a468_39ec3422313540f7b3d309914873959f.pdf?index=trueIn PDF document text
  • http://javamav.rf.gd/29198944317.pdfIn PDF document text
  • https://f766a7e9-a0d0-4e3a-bf7c-946d2e8c2ff4.filesusr.com/ugd/bddb96_1336530af47844259beb214a01a23e51.pdf?index=trueIn PDF document text
  • http://fibejebovef.epizy.com/lokirejapuxewap.pdfIn PDF document text
  • https://88211235-bf86-4d40-a6ec-a052db2f682e.filesusr.com/ugd/94e5ef_1caf6c17cc924152b70a15dd91bbdbed.pdf?index=trueIn PDF document text
  • https://983c8978-ad56-435f-a988-47358aa6040c.filesusr.com/ugd/06a663_cbf3ec0071df4eed9d1f51e245c370c2.pdf?index=trueIn PDF document text
  • https://0ccb9a81-bd3c-41bd-bc79-2352350f0e5e.filesusr.com/ugd/95ea6b_381a431ad4414a4ba500aca8aad5bc1a.pdf?index=trueIn PDF document text
  • https://5b5cf7c4-d983-4e27-bd54-44d52fc9074e.filesusr.com/ugd/2f9450_97671e717f04470c996f64bf9a5c70ba.pdf?index=trueIn PDF document text
  • https://eee5dff6-7331-416e-acdf-593d0c386862.filesusr.com/ugd/21e9e0_4d83b4c96df041ab8484b597522cd93c.pdf?index=trueIn PDF document text
  • https://c2dbac7f-2075-4dc1-ad03-af0d0352bff2.filesusr.com/ugd/278743_28aed2caf13a4c7c830b22ac0b4d74ef.pdf?index=trueIn PDF document text
  • https://6b2d4799-12fc-456d-8881-596234ac9a0a.filesusr.com/ugd/ae8ff6_5a39279d175544feb85dfded14ca2a9e.pdf?index=trueIn PDF document text
  • http://wijuromosumeko.rf.gd/11993336305.pdfIn PDF document text
  • http://mabazekow.epizy.com/ansel_adams_basic_techniques_of_photography.pdfIn PDF document text
  • https://94226b1b-8363-4ad6-a779-e61b7b16ff5b.filesusr.com/ugd/b3bc21_76f59e18f17b49f5819c490937eb0527.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.