Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jottigo.ru/wix?keyword=emoji+icon+game+answers PDF link annotation

  • https://static.s123-cdn-static.com/uploads/4475989/normal_5fee67d29b1b5.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4411219/normal_5ff6589c2a7f8.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4497695/normal_6031f0b011131.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4488103/normal_601d4c8fbf1a8.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4471509/normal_600f86be2462d.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/232fddf9-e522-4f2c-bb4c-3c798f415b56/powerback_5250_generator_specs.pdfIn PDF document text
  • https://s3.amazonaws.com/gixawetopoli/82214401802.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/547b2a49-0679-4ea3-95cd-3b0994ff781c/what_does_rosemarys_baby_look_like.pdfIn PDF document text
  • https://7f2467c6-0d80-4e38-8df7-27624e0b9669.filesusr.com/ugd/e19533_2084b100471b469787bbe92997c25b10.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/wupagivoz/ark_survival_dedicated_server_guide.pdfIn PDF document text
  • https://0df6220b-9630-4647-aab6-0d9db69b9d59.filesusr.com/ugd/8b97dd_00ff43adfca64d32a06eab755e5d6db2.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/8db72c17-97a8-4e29-ab1a-283873cbbe66/blood_bowl_tabletop_teams.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3ff00678-f268-412c-b5e3-067c28a07ece/what_is_a_loan_operations_specialist.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/692697e9-0d1c-466d-822d-a955490f2c97/does_golds_gym_have_free_weights.pdfIn PDF document text
  • https://s3.amazonaws.com/babetafaperaxov/special_26_songs_wapking.pdfIn PDF document text
  • https://s3.amazonaws.com/gofiguj/tamasha_all_songs_in_pagalworld.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7ab1f761-e0ec-4c40-8ffe-4ef51646c7c1/how_the_grinch_stole_christmas_book.pdfIn PDF document text
  • https://s3.amazonaws.com/wewuxuviwar/winudozuzipizawajujinaf.pdfIn PDF document text
  • https://5071cc05-3fa2-46b1-b944-d2523ca4b51d.filesusr.com/ugd/62e2c1_064a33fd5f7043eead9bd135809fb245.pdf?index=trueIn PDF document text
  • https://9e2b3e3a-6a02-4d3b-8ba9-5acc01041672.filesusr.com/ugd/66c878_4701039fdb4a480388b0ecc8887b2292.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/dosalapasenow/andhra_pradesh_pin_codes_list.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e633fdf9-b6d0-42f8-aef5-8dfc79ec1f2d/13187631212.pdfIn PDF document text
  • https://s3.amazonaws.com/getizar/lobbying_proposal_template.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/65a48a67-393c-4f5f-bb0e-b67761d4dbf5/big_green_egg_smoked_turkey_breast.pdfIn PDF document text
  • https://s3.amazonaws.com/dojonuta/zilelamebadexenewipawikob.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c17c8f70-e476-4281-871a-e4595668a197/what_is_the_order_of_the_lord_of_the_rings_trilogy.pdfIn PDF document text
  • https://a3c35cc3-4a3f-4d41-ab51-8b3e4b114d30.filesusr.com/ugd/2b25b5_099a60faa56f419481fb211448dc2f6d.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.