Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://leonvi.ru/123?utm_term=cnp+assurances+annual+report+2018 PDF link annotation

  • https://felomavemupej.weebly.com/uploads/1/3/4/5/134583365/6438707.pdfIn PDF document text
  • https://mixizuvas.weebly.com/uploads/1/3/5/3/135383824/gigosed.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4413475/normal_60543c216f954.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4450156/normal_5fdad70aad89d.pdfIn PDF document text
  • https://cdn.sqhk.co/wobuwozavenu/PigiiSx/kifugosumo.pdfIn PDF document text
  • https://cdn.sqhk.co/pedagukar/pwIijjc/warhammer_adventures_attack_of_the_necron_review.pdfIn PDF document text
  • https://gilawidukawopux.weebly.com/uploads/1/3/2/7/132741225/4741556.pdfIn PDF document text
  • https://cdn.sqhk.co/xifusajexom/BPhbLsM/syncios_audio_recorder_apk.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4485149/normal_5ff1465d90781.pdfIn PDF document text
  • https://cdn.sqhk.co/serodozire/dnrgj62/pc_creator_pc_building_simulator_ios.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4385422/normal_5fc6f3b368fb3.pdfIn PDF document text
  • https://wokesije.weebly.com/uploads/1/3/4/5/134597961/gipopumiwilalenonu.pdfIn PDF document text
  • https://cdn.sqhk.co/wuvexudid/eijOBiu/zapezizojixewedevibolo.pdfIn PDF document text
  • https://pelunukemuf.weebly.com/uploads/1/3/0/7/130776607/c93a1d1304a360.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4408180/normal_603ebbfcbe8df.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://62dace35-232c-43a2-b3e8-6cf19ad57148.filesusr.com/ugd/42ae31_c2c5c4cf42c84afbac9009aa77ae272d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/02fc6b9b-479f-4e79-873e-d05c59f68d11/who_invented_telescope_in_1608.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c000d519-4c21-4ff7-ac95-adbbf01a886f/apc_back-ups_es_350_flashing_green_light.pdfIn PDF document text
  • https://b5f169ef-6bcf-4d19-a24b-32bdc9dd7a5f.filesusr.com/ugd/2e79a6_f812255dfe524dca8564b8eeaf08fe3d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/e4a96076-cb4d-4645-8837-16a33ee1859c/student_record_management_system_project_ppt.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/749818f0-455e-41fa-8693-7b823f09b70a/pomexujuxiluxibizutodu.pdfIn PDF document text
  • https://73e25548-3913-4bbb-aa69-a1b25f69568d.filesusr.com/ugd/cece23_6f752eab9239496f9ea39921a976516f.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/c26588eb-2521-45c1-a61e-8a1adbfc5f53/wekoxuwogisud.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/30c13501-d3ea-4488-bc64-ab81e8f66353/62214976542.pdfIn PDF document text
  • https://f4b9ed98-44c1-44e6-9966-d9817cd43de7.filesusr.com/ugd/9ced5d_f9288f0f2a9c42dc85ca4160e794a694.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/b7b3e8ec-60dd-498f-817a-9703836e3ea5/how_to_restore_ipod_nano_1st_generation.pdfIn PDF document text
  • https://3b0fe5ff-7f86-489c-8138-fc984e51136c.filesusr.com/ugd/bfd78a_cfa32eb9bb6348688f39db140252b25b.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2da4480e-216a-4d6d-abe2-ed9d5d6c9b92/a_que_edad_del_caballo_se_puede_montar.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/730a1da7-21a5-402e-a6ac-0b57165d8ee5/who_owns_wgn_tv.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/451592b6-d559-4aed-af61-ec218096e6d0/alphatrak_2_test_strips_and_lancets.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.