Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://mezovuduw.ru/strik?utm_term=batman+joker+comic+killing+joke PDF link annotation

  • http://static-get.top/how_to_read_stock_charts_for_beginners5zxaz.pdfIn PDF document text
  • http://twirlini.com/any_calls_for_messengero3x54.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://591379ed-26d0-4405-baa7-5b8dadede013.filesusr.com/ugd/866ffa_e4604107a9cc4892992405ee6d98748b.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/76a457fb-e6c7-4645-9b46-28c167d71efc/39454700720.pdfIn PDF document text
  • https://dab7fb03-f2af-4a8e-9cb9-31de623bedb3.filesusr.com/ugd/58b596_eeb8e4ca5253442ebfc09b6951753dd8.pdf?index=trueIn PDF document text
  • https://e60c805d-b9e1-47fc-b045-983511e9ac1f.filesusr.com/ugd/116bb2_95daf3b50b4b4902b5fea077725b2f83.pdf?index=trueIn PDF document text
  • https://ac4cd5cf-e861-4b1b-a585-e47049f737a6.filesusr.com/ugd/843280_872033c1347f4abcbda55d305fd8638d.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/kuboki/6147946874.pdfIn PDF document text
  • https://6f8cb219-4830-455d-9ced-b55e65700e85.filesusr.com/ugd/fd30ac_d03af4a8e466447e92070b632cbcc09c.pdf?index=trueIn PDF document text
  • https://2ea9429b-0332-4ee6-bb75-ab9535b56c99.filesusr.com/ugd/e2f7e1_904aec711a3946d29dff2434dae152c7.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/pozokimepe/71308640946.pdfIn PDF document text
  • https://47c0d0ed-94e3-447f-940a-e265262d053f.filesusr.com/ugd/a43ec6_18e8fddc5e434299b4d52897135deae9.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/3115056b-739e-4ae9-b053-5f6aa18f6aeb/maytag_fridge_repair_near_me.pdfIn PDF document text
  • https://550dfcec-0280-4316-a0d5-68b74a7a20b9.filesusr.com/ugd/f59309_b648c440d7d64cea8a93f091398b08be.pdf?index=trueIn PDF document text
  • https://d8acad56-eb9a-42d1-a06c-a695c5b02328.filesusr.com/ugd/0ad6c7_ff56a8a986d74b7fa400def93753c3c2.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/e3efdfb7-7247-4439-9aae-cbe3da1b8dd4/514888399.pdfIn PDF document text
  • https://a2214900-82f6-4ed5-a432-d5ffd14110fa.filesusr.com/ugd/306b6b_fd971d3315fe42a8afec0c66c2e2dd98.pdf?index=trueIn PDF document text
  • https://5a6df620-610b-4d6f-8f1b-71e936bb70bc.filesusr.com/ugd/1f5cef_91a3759b9ec0458093a569bbe7ecd6f7.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/bofake/disutul.pdfIn PDF document text
  • https://95c758d6-fd33-43c6-b5d0-f1f55e07e946.filesusr.com/ugd/cb0188_608342da0c9d45d7aaaa784fd61d7d57.pdf?index=trueIn PDF document text
  • https://1350f94c-8d6f-42b4-8351-24983ad6a49a.filesusr.com/ugd/4aae87_7219e9c479fc4e66866e9ea38c72508e.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/wiremeresegikon/75272958488.pdfIn PDF document text
  • https://75e6061f-eb7a-4ce8-b546-077bf96366c3.filesusr.com/ugd/2dfd19_3077bc4853ce429eb296cb4c628ec18c.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.