Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jacksth.ru/strik?utm_term=chocolate+black+and+tan+cream+red+miniature+dachshund+puppy+for+sale+california PDF link annotation

  • http://jobware.pro/bedotanaralir25f99.pdfIn PDF document text
  • http://spoonnumberone.xyz/dorimevefaxqkadw.pdfIn PDF document text
  • http://sodaapp.pro/landmark_vs_milestoneko90g.pdfIn PDF document text
  • http://slamelina.website/falomevefuwavovenibezootinc.pdfIn PDF document text
  • http://deutschebank-meine.com/how_to_clean_out_whirlpool_dishwasher_drainrbks4.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4383802/normal_604b900b87b93.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4379053/normal_5fd7bc3672b7c.pdfIn PDF document text
  • http://podarokinsta24.online/la_veille_de_nolfl9u7.pdfIn PDF document text
  • http://opit.space/1074402139sp1p7.pdfIn PDF document text
  • http://ewop.space/pimojizuxenidololowizxbjnu.pdfIn PDF document text
  • http://prodive.su/do_treadmills_have_a_weight_limit0eihn.pdfIn PDF document text
  • http://luminar3-download.xyz/generate_battery_report_windows_8etih0.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://4f640d82-8365-4c22-93d6-dbd3427c3fb0.filesusr.com/ugd/55e8b7_a62430790e1440c69435037f80078f83.pdf?index=trueIn PDF document text
  • http://koxupukilox.rf.gd/37602449974.pdfIn PDF document text
  • https://bb491b24-4c81-4ccc-8daa-bf1baeb171c2.filesusr.com/ugd/93c935_3fba3dc39382412e98d70d9a5422340a.pdf?index=trueIn PDF document text
  • https://436240a4-ef10-404e-ad90-c5cab949c7af.filesusr.com/ugd/3fb742_49efa4580040436bb56ed5749d1f8c6c.pdf?index=trueIn PDF document text
  • https://9387bd13-3746-4408-b474-2867f26e464d.filesusr.com/ugd/ace02d_072cc42ed7bf47e4975c8b3ab41f7d5f.pdf?index=trueIn PDF document text
  • https://c580675e-8888-491d-8c80-3106eaac86fb.filesusr.com/ugd/c8a981_c5ee3ff2dc134cbfa641ce8646fc9f33.pdf?index=trueIn PDF document text
  • https://f730d15c-1921-46d2-b6d4-288333e40990.filesusr.com/ugd/e2c223_8d4f977a441e4517ac2df5e9f2d40846.pdf?index=trueIn PDF document text
  • http://samepuwewar.rf.gd/que_es_el_acido_clorhidrico_del_estomago.pdfIn PDF document text
  • https://7e6b698e-d56f-4a21-8c48-787e2f6d39f4.filesusr.com/ugd/7836c9_a713102567294437b332a0c71ceb56b9.pdf?index=trueIn PDF document text
  • https://ce2645ba-e89a-43d5-afff-5c0150757291.filesusr.com/ugd/c63dba_16fd85cd5bcf4656abf680147d7f7eeb.pdf?index=trueIn PDF document text
  • https://305aa2e3-e1d2-413d-aa2e-f1bb83d03ded.filesusr.com/ugd/92ee2b_ccbaf8d38f29491c8492168181b87916.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.