Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://gimoguvi.ru/strik?utm_term=spt+humidifier+not+working PDF link annotation

  • http://nutristrike-shop.ru/17288731523kek7a.pdfIn PDF document text
  • http://rawenspant.online/short_romantic_stories_to_read_online_for_freer34qq.pdfIn PDF document text
  • http://priz24.site/cheekati_gadilo_chitha_kotudu_movie_movierulzenss7.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4428083/normal_5fee2f7249cf2.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4421939/normal_602517a5ca84a.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4448991/normal_60100e0f61b1a.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4427287/normal_605468e320a7e.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4376629/normal_5fcf85b4c326f.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/6af97bbe-9a84-4f90-90ee-5d626ef4d9f5/tonunope.pdfIn PDF document text
  • https://s3.amazonaws.com/bofake/20308868457.pdfIn PDF document text
  • https://387a498e-9551-4239-9507-3183ba214552.filesusr.com/ugd/cd403b_d5fcd2bf41f94a0b8596a9cc7371f993.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/9f324097-2a7e-44ec-89bb-445e73d8b67c/resistor_color_code_calculator_4_band.pdfIn PDF document text
  • https://s3.amazonaws.com/bokofapig/poxegogatejutufezo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/28e1dd2b-0c24-4141-bffe-c27683a2445d/15874517550.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dc3e428d-4299-4e35-8bc6-b65a28be5877/mugogid.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b2c33c6d-e9f3-4a7a-9841-bfe94f708ad3/duvuwipel.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fe476eaa-856c-488d-93a3-2e922f3081d3/how_to_pair_bose_soundsport_earbuds.pdfIn PDF document text
  • https://7b806e58-2e0f-4c22-b5e1-e0f71c4d6e86.filesusr.com/ugd/8da65f_37b641b1b64c4fa187306c977454dc77.pdf?index=trueIn PDF document text
  • https://85fc0914-20e3-4f1c-be8c-de7e6f89f47e.filesusr.com/ugd/a44510_e7ac1ff787f34a47b3090bac465ff9cc.pdf?index=trueIn PDF document text
  • https://f39f7cea-6337-46de-af4f-699959e6db0a.filesusr.com/ugd/004672_92ae4043211243648ba20e2677945020.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/tibitexil/kohler_generator_20resa_service_manual.pdfIn PDF document text
  • https://s3.amazonaws.com/xurixado/is_logic_pro_x_available_for_macbook_air.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b16efa6e-3826-45f3-bc9e-f875355c5d95/dramacool_house_of_spirits_tvb.pdfIn PDF document text
  • https://1a6defe7-92a0-4357-8a70-d3bce85d30c9.filesusr.com/ugd/385065_c0a7054b8dbe4372b37bed56b3b3a85a.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/woxojuxafopuv/monstrous_compendium_outer_planes_appendix.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.