Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://midufefew.ru/strik?utm_term=clicker+garage+door+keypad+programming PDF link annotation

  • https://cdn.sqhk.co/budajawisore/ixrvaRU/lixulugavidozozenupe.pdfIn PDF document text
  • https://gafepodaxo.weebly.com/uploads/1/3/4/6/134606739/4681846.pdfIn PDF document text
  • https://cdn.sqhk.co/luwagoma/Gjgfhhv/thyroid_nodule_management_guidelines.pdfIn PDF document text
  • https://nujamoxe.weebly.com/uploads/1/3/4/2/134234607/gudosadon.pdfIn PDF document text
  • https://tunedewujanan.weebly.com/uploads/1/3/5/3/135345761/kofoneviwu.pdfIn PDF document text
  • http://shoop-fg.ru/headless_horseman_template_pumpkin_carving5g0ob.pdfIn PDF document text
  • http://vorecan.space/antennaweb._org_tvfool._comxf316.pdfIn PDF document text
  • http://shoes-storie.club/44605020959tw341.pdfIn PDF document text
  • https://cdn.sqhk.co/tamoravuwera/OhiPmhb/defender_legend_premium_hero_champions_td_mod_apk.pdfIn PDF document text
  • https://figowemepiwe.weebly.com/uploads/1/3/1/3/131398533/9397805.pdfIn PDF document text
  • https://cdn.sqhk.co/wukatigubo/Shagdii/tetris_ultimate_xbox_one_for_sale.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://de99934f-f465-4d69-af5e-14f317c0a7c6.filesusr.com/ugd/4fea5c_bcc8c320034a42ec8992be65d96cd0e0.pdf?index=trueIn PDF document text
  • https://03ca3561-abfe-48ca-9b59-b1b2b77f8126.filesusr.com/ugd/1af49e_2ec1304c247943619afe5126a10564c8.pdf?index=trueIn PDF document text
  • https://737c154f-ca75-4484-807d-9d5c19d76377.filesusr.com/ugd/7e84b7_064180f84b4a4d7abf24620f0ff75178.pdf?index=trueIn PDF document text
  • https://cc652f91-b1ab-470c-b36f-46d838ef85b2.filesusr.com/ugd/fbccce_704d38f22de2475aa2dac4ae8c972dd4.pdf?index=trueIn PDF document text
  • https://d62ff7d9-aefc-4ab8-8cdf-af38868aea16.filesusr.com/ugd/54b9a1_f6ae66c0ffb644df81ca2b851b03d11a.pdf?index=trueIn PDF document text
  • https://d7179dab-c972-4501-9f4a-16044ca71e84.filesusr.com/ugd/434f74_4d2d9f6026514fa2ac7275bcab5adf91.pdf?index=trueIn PDF document text
  • https://107a3552-ed21-4f5d-95e3-510b6eae4444.filesusr.com/ugd/21bbef_9917cfebfe7d4946a62e7fc1675e548b.pdf?index=trueIn PDF document text
  • https://88e15a2c-c4d8-47f8-8ed7-52d4e9d63fa2.filesusr.com/ugd/0010c8_67f25b04ccc9419789297e0218321ff7.pdf?index=trueIn PDF document text
  • https://d7ae471b-a447-437d-81b4-4e603f8679d9.filesusr.com/ugd/0a3240_a469788c44964559a074d8bdfe3262e7.pdf?index=trueIn PDF document text
  • https://e192e36c-395d-4660-9df6-aa7aed00c30a.filesusr.com/ugd/3aee12_723022eb35324edca22f317dfe5bc550.pdf?index=trueIn PDF document text
  • https://c31d65df-273c-4bcc-acfb-7b03b0724b99.filesusr.com/ugd/e7e4a0_3c98c82ac4b74c41b4ce9886cc686fb7.pdf?index=trueIn PDF document text
  • https://e1bd05e7-a2ed-43df-b5fc-9bc8ee0b1a84.filesusr.com/ugd/08acf3_3fd07748170640cd825320b6f02661af.pdf?index=trueIn PDF document text
  • https://4da44922-6ee1-4515-aed7-54c3d6b51f77.filesusr.com/ugd/243a28_55017ee6244a4d56b0cf97e230424989.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.