Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://xezojetit.ru/strik?utm_term=why+is+my+oil+burner+not+firing+up PDF link annotation

  • https://cdn.sqhk.co/kewusikata/aakF3hc/old_romantic_mashup_songs_list.pdfIn PDF document text
  • https://cdn.sqhk.co/gebitasixa/ghfFhjh/fnaf_ar_catalog.pdfIn PDF document text
  • https://cdn.sqhk.co/gobisurav/bjhcI5S/3455102200.pdfIn PDF document text
  • https://cdn.sqhk.co/zevinikiwi/cYjgdja/miniature_wargames_magazine_website.pdfIn PDF document text
  • https://cdn.sqhk.co/nilesatu/Qhggcgf/gudajutimowotu.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4496389/normal_60493922b77b1.pdfIn PDF document text
  • https://cdn.sqhk.co/vitozogog/h3gjSjb/70455254057.pdfIn PDF document text
  • https://cdn.sqhk.co/jawubibegeba/jeCibgd/algebraic_expression_worksheets_for_6th_grade.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4393883/normal_5fc6b824ddaa5.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4421476/normal_60259806457fa.pdfIn PDF document text
  • https://cdn.sqhk.co/jurugaguvedu/cb6bKif/vr_project_warszawa_opinie.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4451368/normal_5fe7cb0c78450.pdfIn PDF document text
  • https://cdn.sqhk.co/kixagixupo/AgizTii/kuvijamipoweti.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4491965/normal_604bc9352595f.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/5b9b72a6-ab50-4de1-b100-889855bf9500/wheel_of_time_11th_book.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f3cf965e-a56a-4be9-b596-b33f7ca6cb3c/zipabazisixujojiputivonov.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bb41ebc0-886a-44ca-9d85-651a21aa4f0d/guxegeza.pdfIn PDF document text
  • https://87da31d5-d184-45e7-a456-0ad082c8bd65.filesusr.com/ugd/55e94a_7bd072b504c145efbec6a42a93edbe0a.pdf?index=trueIn PDF document text
  • https://a4067306-84c0-45ce-9c36-3cbb795fcb37.filesusr.com/ugd/d5b970_a68f25db138e4ebeacf644fc4e037686.pdf?index=trueIn PDF document text
  • https://737bf953-b780-43bc-8af0-312ed5328a40.filesusr.com/ugd/017c44_730f926726eb4c079a9442700f4df272.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/0a8a769c-1b56-4af0-b20e-d3006c4d149a/white_fang_movie_harrison_ford.pdfIn PDF document text
  • https://44f39d5c-a655-4437-91b6-62b11e148e71.filesusr.com/ugd/eb4c03_1cdd09ce5250445c89827189501c7493.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/c1174084-2ef7-4b7a-9bea-60ea1e943114/la_leccion_de_august_audiolibro_espaol.pdfIn PDF document text
  • https://3568c1c9-c281-4b9a-9ea9-d5d291e0176b.filesusr.com/ugd/e5d8db_a1b5214505974baa82f73089c4816b95.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/b468dd82-1426-4f78-b8dd-76c498dcf22a/87307337912.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dc6c93af-66f5-42b1-b561-d1b1558b1c30/simple_present_wh_questions_exercises_with_answers.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/72182b7d-0444-4d02-a5bd-9e71c574a519/fimovapifugidusafimaxuru.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.