Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://seumenha.ru/wix?keyword=world+conqueror+4 PDF link annotation

  • https://libirobu.weebly.com/uploads/1/3/5/3/135336219/9188828.pdfIn PDF document text
  • https://s3.amazonaws.com/wapabefizosumi/puzzle_bubble_shooter_game_free.pdfIn PDF document text
  • https://s3.amazonaws.com/sefukirexuwekij/100s_chart_interactive.pdfIn PDF document text
  • https://s3.amazonaws.com/tolivajupeku/how_to_put_two_points_into_point_slope_form.pdfIn PDF document text
  • https://napuvenorabinu.weebly.com/uploads/1/3/4/4/134490891/a89cc3afec.pdfIn PDF document text
  • https://cdn.sqhk.co/sarunasol/1rhcigq/thorogood_boots_sizing_reviews.pdfIn PDF document text
  • https://pidowiwosuzaji.weebly.com/uploads/1/3/0/9/130969191/nugirazo.pdfIn PDF document text
  • https://s3.amazonaws.com/zafirawit/jijibelugonota.pdfIn PDF document text
  • https://cdn.sqhk.co/lomokubaf/lMLgdDr/zombie_hunter_post_apocalypse_mod_apk_hack.pdfIn PDF document text
  • https://cdn.sqhk.co/bofotabi/yidggnI/foneganiwa.pdfIn PDF document text
  • https://s3.amazonaws.com/rumezo/54583775464.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://1c8fadd7-09eb-4d2b-9d42-8e747ba5ce52.filesusr.com/ugd/60625b_0e17d727b64b4c68855f0339eab4f538.pdf?index=trueIn PDF document text
  • https://9fbaa0db-fe9e-443e-b503-3d02ea494c21.filesusr.com/ugd/d417e9_e4cf6b6494444bc3a1d815508df8f88f.pdf?index=trueIn PDF document text
  • https://46fb9a51-9e16-4ad8-811e-2f7ed01702f7.filesusr.com/ugd/53363c_6035e1d3b40d4737bfd8c1a8e3f4b74d.pdf?index=trueIn PDF document text
  • https://acfc0e76-311d-46af-9c13-f46c112eb424.filesusr.com/ugd/f90bad_fd94270b2f974e7bb137197a43a1002b.pdf?index=trueIn PDF document text
  • https://d064ede3-316f-4d13-8ec5-014b2136b3bd.filesusr.com/ugd/154db6_17715bf8988e4ffe9fffbd51eed016b9.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/53a530b4-5166-4c8d-bf47-815fbafe1f9f/fowogudibanovigesuzob.pdfIn PDF document text
  • https://7f3dc8b3-869c-44c5-82eb-14ae88d57796.filesusr.com/ugd/dc4ca1_8b6d5d583baf4a31bfcdbbb447f7b445.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/0aba65b4-a775-45eb-89b3-b396791d7fd9/can_beats_studio_wireless_be_used_wired.pdfIn PDF document text
  • https://033a7475-7ccb-45c1-8f1e-38fd320d48d0.filesusr.com/ugd/03a576_62528a53b7554ddf90432fce6f5029c9.pdf?index=trueIn PDF document text
  • https://aa4de0c4-a7fb-47f6-97fe-5721705e71c1.filesusr.com/ugd/824332_d4f8007bab6b4b269cf4dcd487d755c8.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.