Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ponafet.ru/strik?utm_term=concise+physics+class+9+icse+solutions+chapter+3 PDF link annotation

  • https://cdn.sqhk.co/jomawutid/eKKjdia/zifibokokosug.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4408584/normal_5fd2694e8ef22.pdfIn PDF document text
  • https://cdn.sqhk.co/nomazotesi/heDih8P/game_center_apk_download_android.pdfIn PDF document text
  • https://cdn.sqhk.co/wanoposuj/jin5ijt/gacha_life_pictures_wolf_bad_girl.pdfIn PDF document text
  • https://cdn.sqhk.co/tinupolureg/ijhBgch/36191824418.pdfIn PDF document text
  • https://cdn.sqhk.co/nimuxugemu/hbhhRfw/gexujufan.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4385434/normal_6020a56468b75.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4372354/normal_603ab41837b48.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://s3.amazonaws.com/muwomapotumugi/auto_tune_efx_3_mac.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/957cb7a1-0018-406b-ae98-30c0c25cba64/29961075677.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/01e100c6-98e0-470a-92fd-1b71da02ce28/59127156594.pdfIn PDF document text
  • https://9f2a6cc1-6e15-4467-beaa-57274ca996ed.filesusr.com/ugd/78f4c3_8616e7fdc4424d12888156e3c09db00e.pdf?index=trueIn PDF document text
  • https://52b03d57-94e3-497b-b2ee-5a576b8f136c.filesusr.com/ugd/67ae49_25c67a5fb26c4800ae5a82b3b9e663c4.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/7007d998-8449-49b4-9270-fa7e1ed0d7df/baritukelamuwigi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6da6da34-ada5-436a-93ae-8fe7c6e375e4/altec_lansing_boom_jacket_jolt_review.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d4c0ed8c-3cd5-4d9b-9551-8a3c671ae71a/jonupakawo.pdfIn PDF document text
  • https://s3.amazonaws.com/bifamomove/bekemozumuzufigufufupikos.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dd9e6786-e41d-40b0-8db4-43df46c24304/caltrans_design_information_bulletin_88.pdfIn PDF document text
  • https://0e098354-e5d1-4afc-9be7-763a70ae5e44.filesusr.com/ugd/ef253e_5a868a7c54354b8a8b13f6124677bc9f.pdf?index=trueIn PDF document text
  • https://083189c9-8220-4687-a375-57be19a37228.filesusr.com/ugd/909b15_9ddafb0a5fcc424386cfed7f94247914.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/sebunuzu/59836567111.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1b3b332a-6fc4-45cd-a48d-19dee710fd2a/juboku.pdfIn PDF document text
  • https://02664c88-84e5-42fa-aae3-682d3a0d4328.filesusr.com/ugd/39d081_8fed94d709a0490f8ec2b70e81d84c23.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/5d5654ba-348c-4cac-a292-fdb53d517f84/minn_kota_powerdrive_bt_45_spot_lock_micro.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.