Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://gimoguvi.ru/strik?utm_term=andromeda+strain+movie+1971 PDF link annotation

  • https://cdn.sqhk.co/libuzewis/gihjHif/81884669986.pdfIn PDF document text
  • https://baxufolodamiz.weebly.com/uploads/1/3/1/4/131408032/3df4fdfff7a.pdfIn PDF document text
  • https://tizukusijevawus.weebly.com/uploads/1/3/4/4/134454617/dumosimabisolexapuv.pdfIn PDF document text
  • https://cdn.sqhk.co/vavetiset/gbhheii/professional_curriculum_vitae_format_doc.pdfIn PDF document text
  • https://femixazate.weebly.com/uploads/1/3/4/3/134363246/7879837.pdfIn PDF document text
  • https://dunebuka.weebly.com/uploads/1/3/2/6/132682868/kafabifekaxapivebi.pdfIn PDF document text
  • https://cdn.sqhk.co/kinanekoxo/2Njjhhe/download_game_world_war_arena_mod_apkpure.pdfIn PDF document text
  • https://cdn.sqhk.co/xilasexiki/5ghN3gj/art_collection_color_by_number_online_game.pdfIn PDF document text
  • https://cdn.sqhk.co/suxejatove/J8hahaX/racing_car_3d_game_apk.pdfIn PDF document text
  • https://cdn.sqhk.co/pasojixaju/hagcicX/real_madrid_football_kit.pdfIn PDF document text
  • https://cdn.sqhk.co/litawoxelida/bhv7Ppg/95243018009.pdfIn PDF document text
  • https://zitozujenuzudip.weebly.com/uploads/1/3/4/0/134042901/rusitekujaw-mobovimixiv-zupokowujuk-vudim.pdfIn PDF document text
  • https://cdn.sqhk.co/fazofasufiwu/ifhLicJ/32638968722.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://d6236f05-450e-4b96-9875-1783d83c708b.filesusr.com/ugd/912de2_29478a4a623e4b928d42d22a15810510.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/6ba26633-e593-4da2-8512-21f0b2d9f23f/ancient_greek_government_interesting_facts.pdfIn PDF document text
  • https://3f735f5a-cd1c-4288-bd93-adeff6e084d9.filesusr.com/ugd/bcc0e4_fd88a32e6113423f9fdf6b5936cb1d41.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/betefowubevat/28041488748.pdfIn PDF document text
  • https://3789e5f8-265e-48cd-8836-241a044b7ceb.filesusr.com/ugd/45ef7e_fb0133b4409347918f46f4c629aebf30.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/fba558cb-07c4-4173-afb3-9260f74a8cb3/71415137899.pdfIn PDF document text
  • https://c1bbde11-5cda-4f7c-8b74-b2fe90b484f5.filesusr.com/ugd/1c8c6c_2e87afca317f494093f480b67c033981.pdf?index=trueIn PDF document text
  • https://bd7a0a6f-bbfd-49cc-ba41-c3f2778102d9.filesusr.com/ugd/9ea91e_3e84abc3bcf94c9caccc9d2e58d176ee.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/6c692ff4-c6cd-4fd2-9277-b272431b6bde/jusaki.pdfIn PDF document text
  • https://s3.amazonaws.com/jedaxopopuko/adirondack_chairs_plans_templates.pdfIn PDF document text
  • https://s3.amazonaws.com/lebaxa/49612445583.pdfIn PDF document text
  • https://s3.amazonaws.com/bubeto/airport_express_base_station_a1084.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.