Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://leonvi.ru/strik?utm_term=matar+a+un+ruise%25C3%25B1or+personaje+principal PDF link annotation

  • http://natnat.fun/85924652799kzxtm.pdfIn PDF document text
  • http://smartcreditus.info/5757279621772mlx.pdfIn PDF document text
  • http://circus.market/6299804424fvo1r.pdfIn PDF document text
  • http://avto-document.site/12559460196g171i.pdfIn PDF document text
  • http://netlysy.online/symantec_endpoint_protection_manager_admin_guide0xlxz.pdfIn PDF document text
  • http://lifeshop.pro/gudelagexulegikupapimakfa8n.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://d99d9bf7-a5e0-49f2-90ac-0d1bc881463d.filesusr.com/ugd/0182ef_829125efd74a4586b0a2178813a3bb61.pdf?index=trueIn PDF document text
  • https://11627308-8c8f-4f08-99ed-0ad85160907d.filesusr.com/ugd/682d1c_8cb470f437e74bcba6c26ee43bf6be29.pdf?index=trueIn PDF document text
  • https://7e8267f5-6380-480e-ad72-df526eaefc07.filesusr.com/ugd/cbe325_8b4555b7d9614fc28845134269387faa.pdf?index=trueIn PDF document text
  • https://69b3109a-7cce-4514-9193-d2106d9976ab.filesusr.com/ugd/3c2969_c43157ee608b4ad486bd9c21b0e9690a.pdf?index=trueIn PDF document text
  • https://1e35b969-1f99-48dc-8aa8-d0fb9638bdc8.filesusr.com/ugd/970baa_f68a97721f3542459a88d471aaaf0627.pdf?index=trueIn PDF document text
  • https://79d86aa2-23c4-4aa0-a0dc-c16ac59ae55d.filesusr.com/ugd/ecb701_8ad5b88ec92546d8ab54c87f5f7c527d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/b6c828e5-1148-4b29-91a8-755de3807734/ncert_solutions_for_class_9_science_physics_chapter_12.pdfIn PDF document text
  • https://f05e0dbb-21cf-40ea-8b71-00b8d6f49a3b.filesusr.com/ugd/b09e1d_a659e99dfcd9429e8065b7d3dc8eabe9.pdf?index=trueIn PDF document text
  • https://1e16da7b-5b4f-4122-a3c4-5c88c9d97cf7.filesusr.com/ugd/83f04e_43499e30be66463e934622d884a9204d.pdf?index=trueIn PDF document text
  • https://1b65b899-5fad-42bd-af9e-a3fb1d6a4c80.filesusr.com/ugd/a2ebd8_0fad9900c0b6479481edfa1456ddad09.pdf?index=trueIn PDF document text
  • https://e028ba52-6c86-493e-86b7-fecf7cd1c3eb.filesusr.com/ugd/bcb9fd_ceb0b99ee6f2477ba96d1890e099945c.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/e87f66d9-fdb0-4d2f-995b-50853b2d7a59/what_are_girl_scout_journeys.pdfIn PDF document text
  • https://bc260b4e-efc2-469d-9102-9c7234992d76.filesusr.com/ugd/b1b3ad_ea43ec6cf5e4482aa60a444c837bad15.pdf?index=trueIn PDF document text
  • https://54179944-c6a3-49b3-9462-5d1939b6aff2.filesusr.com/ugd/49f5ef_f181503cbe6f4e6b83a1e1fcccfdac6c.pdf?index=trueIn PDF document text
  • https://51da6a7d-ee05-4a49-87ee-1b74af3aeb07.filesusr.com/ugd/b80405_5cff089441ca456ab528d8239493734f.pdf?index=trueIn PDF document text
  • https://fdb4f28e-c637-431f-967d-457feef73efb.filesusr.com/ugd/cf5aa9_ea1bcc0bfe984073bd02e5367d0a57d8.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.