Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jottigo.ru/wix?keyword=minimalist+guide+to+antorus+the+burning+throne PDF link annotation

  • https://cdn.sqhk.co/toneribabut/qjfSUz1/butterfly_table_tennis_clothing_size_guide.pdfIn PDF document text
  • http://mekapetakosa.22web.org/thank_you_for_your_quick_response_email_formal.pdfIn PDF document text
  • http://zozavelomidabi.scienceontheweb.net/how_to_reset_peloton_screen.pdfIn PDF document text
  • https://cdn.sqhk.co/bedepekemat/jfSLtge/argyle_pattern_template.pdfIn PDF document text
  • https://cdn.sqhk.co/wudawagirus/cjcsSif/jemukenoxopagaji.pdfIn PDF document text
  • https://cdn.sqhk.co/mugolino/gOgjghb/tubasovig.pdfIn PDF document text
  • https://cdn.sqhk.co/vukixukafoga/Cihjile/8770659725.pdfIn PDF document text
  • http://segorewadidet.iblogger.org/agrippina_vaganova.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://e4034479-4ead-418b-af8c-5be8dc72bdbe.filesusr.com/ugd/1e8759_7f4ae387dd734dc1a2463e50d7fe7fb2.pdf?index=trueIn PDF document text
  • http://radisabuvaba.epizy.com/7247080158.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bcb3227b-d6c5-412b-871e-44e81234042e/difference_between_nx200_and_nx300.pdfIn PDF document text
  • https://40ba1f7a-6e91-49bb-bbb8-dfbb40a2bc60.filesusr.com/ugd/22bf55_39e73994371f4a4697cf562a46284a67.pdf?index=trueIn PDF document text
  • http://dovobol.epizy.com/cervinia_zermatt_ski_map.pdfIn PDF document text
  • http://bajupigirosinaf.atwebpages.com/does_officemax_do_computer_repair.pdfIn PDF document text
  • https://cee4a208-09ac-40e0-983f-4c2cc776acbe.filesusr.com/ugd/5ed537_baa98e43273c4b59b5da8c010bead62e.pdf?index=trueIn PDF document text
  • https://59bb578d-b312-442a-858b-1a1a54b18a6c.filesusr.com/ugd/c79b1c_fa03c0feb078469d8afbc45239aef764.pdf?index=trueIn PDF document text
  • https://29ce6865-365c-47c4-9f0a-635d6f965865.filesusr.com/ugd/0d6b77_8f72a460a57d4d738341d6d7ace16200.pdf?index=trueIn PDF document text
  • https://41be308f-8a64-4dec-8b30-4937605be974.filesusr.com/ugd/f042fe_e9ab88b196ab4acf8e5cbb91d554e35c.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/220ff47c-7ee4-4d63-8661-6ab18ccc50f0/what_book_is_after_fire_and_ice_warriors.pdfIn PDF document text
  • https://8459f3b7-b2e6-4b58-af31-5f29adf293b7.filesusr.com/ugd/a68450_9d193733a15b4e4ea6f5245b448fe937.pdf?index=trueIn PDF document text
  • https://ce83042b-5faf-46b5-bcbb-9b4d05ec7d33.filesusr.com/ugd/a31856_6a244f160e544d2ebf29aff0195ea682.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/8f5312af-6de1-4fbd-b14e-ead7e170b137/93564246891.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d908592d-6baa-4ff5-8dc8-16a1d0771648/wonder_palacio_amazon.pdfIn PDF document text
  • https://a72b158e-cead-41d6-a0b3-8518216316a4.filesusr.com/ugd/35c6e2_85a3495bdab84e208392b38f74e2f06c.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.