Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://zajinet.ru/strik?utm_term=best+balance+exercise+for+seniors PDF link annotation

  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/3213eeb2-9dd1-44af-a075-058c7537113e/92848285917.pdfIn PDF document text
  • https://ecf1b359-4982-44d9-836f-7e6f5fec4aa1.filesusr.com/ugd/da15c8_4e70a68110064a4a817b73c13d7d9b6f.pdf?index=trueIn PDF document text
  • https://c30b87d5-e38e-4f4c-8f61-e356d9eaafe8.filesusr.com/ugd/347120_54cc743fa8974f4a9a4606f2a095905b.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/lovomijelun/zepogiremipugipolawo.pdfIn PDF document text
  • https://4f640d82-8365-4c22-93d6-dbd3427c3fb0.filesusr.com/ugd/55e8b7_24248184c8bd47f1a5a4a0d0f3f73955.pdf?index=trueIn PDF document text
  • https://434dcbc4-7bd9-40fe-99bf-e102daebf961.filesusr.com/ugd/07ef24_6f631b508e47416caad419b578901c69.pdf?index=trueIn PDF document text
  • https://8dac4d01-2cd1-45d2-8b5f-6005f802adc9.filesusr.com/ugd/1f96ce_a665916e0f8e46eab34bf5fb736b49a3.pdf?index=trueIn PDF document text
  • https://ec679cc6-872a-45a8-b2fd-b1bc8f6ddb77.filesusr.com/ugd/d1d005_86733d886b8c4736b196f3b36ce9ff0a.pdf?index=trueIn PDF document text
  • https://e20d271a-53e3-41f9-9180-d6cd5f9fd148.filesusr.com/ugd/6cfc61_1aec98befa4c4b4293506e5f4f8a83a1.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2b9a1691-a041-4069-91ef-80c6c25c7019/7542510678.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2e249175-be41-42c3-8c58-1277f2652731/zugagozobetuzufuxoninufup.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/48a2f309-7883-4ac4-a94d-993c8eeec5f5/sba_definition_of_seasonal_employee.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4fa2278c-5c36-4152-9361-dc57d8f659c3/how_to_use_kill_a_watt_meter.pdfIn PDF document text
  • https://ddb1515c-011f-4d6c-9a6c-b305a2039a85.filesusr.com/ugd/477ac5_9eaa096c1d834a4c9b5ac62052eef7fc.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2c012269-4ed8-44d8-90ca-6a226fb8f291/only_love_is_real.pdfIn PDF document text
  • https://882e4f53-a7e1-4d4a-89e8-a6e6d9f9b805.filesusr.com/ugd/9a13d2_e11e52afdad64e369ca2dfa4a64259f6.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/nasitevu/how_to_find_exponential_line_of_best_fit_on_desmos.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e61a42ca-6143-4e35-a6de-984b5b39065c/84577815137.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9ab19a7f-a8be-464d-b6f7-f34a01bb581a/16785244186.pdfIn PDF document text
  • https://c9254e9e-0e71-498a-8384-ab4c929b52b4.filesusr.com/ugd/0699ff_62ac3c711daf43969d0b65212c54ada6.pdf?index=trueIn PDF document text
  • https://76c87692-cca9-4651-be8e-de6412dad411.filesusr.com/ugd/fdad67_55f0e15e1ee64db7bf187267e245d58b.pdf?index=trueIn PDF document text
  • https://4f640d82-8365-4c22-93d6-dbd3427c3fb0.filesusr.com/ugd/55e8b7_c42c6c9d0c814362a01055f291c7a9eb.pdf?index=trueIn PDF document text
  • https://108bb973-5399-4bf7-a70e-a18780752cac.filesusr.com/ugd/760a88_a31f436bfaee4cfa908c976c813c6959.pdf?index=trueIn PDF document text
  • https://de99c131-68bf-4271-bcef-cda292486844.filesusr.com/ugd/f5892c_4d2d2ca6accd4f11bae214ab7da02445.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.