Malicious PDF — malware analysis report

Heuristics 8

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
  PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
• LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
  Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://vilenefex.ru/wb?keyword=las%20cr%C3%B3nicas%20de%20narnia%204%20pel%C3%ADcula%20completa%20en%20espa%C3%B1ol PDF link annotation

  • https://kitomejefu.weebly.com/uploads/1/3/4/1/134108571/cabcc22cf138.pdfIn PDF document text
  • http://handler-autoscout24.com/fun_free_race_car_gameser6i5.pdfIn PDF document text
  • http://securityofusersdevicesonline.site/supplier_disengagement_plan_templatese5pd.pdfIn PDF document text
  • https://xozipirun.weebly.com/uploads/1/3/5/3/135324749/aed187481215ee0.pdfIn macro / runtime command snippet
  • http://wisecreditscore.info/park_cardiologia_pediatricawsvem.pdfIn PDF document text
  • http://roman-holidays.shop/zojogunik6dg8q.pdfIn PDF document text
  • https://1c684d3d-b1aa-4d58-8f8e-408f9cf37fac.filesusIn macro / runtime command snippet
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://1afae0f6-9e35-4dc9-9db7-5dbf78511926.filesusr.com/ugd/afe78f_cc6a4556e1da43dc9111d1034d4ec28f.pdf?index=trueIn PDF document text
  • https://6a1e2a5f-c456-4288-b9d5-5378f87870fb.filesusr.com/ugd/076fac_aa9e7ef8ea3a4d86a4fd703a7f577ce4.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/zibenoroduzuw/jibab.pdfIn PDF document text
  • https://16012499-1299-48b0-8cdd-5f23a7749958.filesusr.com/ugd/fafc38_99d44366283647179a95a1148646ad70.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/tipikaxe/67538564911.pdfIn PDF document text
  • https://f9c81679-ddb1-4746-ab40-32673edc426c.filesusr.com/ugd/2eff39_1601a3fa731649ab8c7cd92038bfca24.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/dc697e61-90ff-4f84-ad06-1ef379151634/how_to_echo_new_line_in_cmd.pdfIn PDF document text
  • https://1c684d3d-b1aa-4d58-8f8e-408f9cf37fac.filesusr.com/ugd/64d889_fbe9e651fdfc4a6c8be2b615b60bc888.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/a9004bac-67ea-4e93-852f-1170f05dfbfc/how_to_draw_a_human_body_for_beginners.pdfIn PDF document text
  • https://s3.amazonaws.com/niwotipugonuvoz/nespresso_vertuoline_coffee_best_seller_assortment_30_capsules.pdfIn PDF document text
  • https://2a07c75e-e898-48ba-b326-4cccc82d0599.filesusr.com/ugd/ff154e_dc7f461aadf14d07813afd78dfaec6d9.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/e873e0e9-e7b4-4147-ae87-d596f0af1d66/m_audio_keystation_88es_without_computer.pdfIn PDF document text
  • https://ba428ff1-d53d-4eb5-bdb2-cc960067f420.filesusr.com/ugd/7041e4_c9c79ca4b4bb462ba78f02a07e5e77fb.pdf?index=trueIn PDF document text
  • https://d8acad56-eb9a-42d1-a06c-a695c5b02328.filesusr.com/ugd/0ad6c7_1de4b9350887443c8565275b87284a9f.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/lanubili/this_is_us_series_3_episode_guide.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/15f5ae9f-0fb9-49e7-81a7-25c58bd97c03/lg_oled_55eg9100_review.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dde6763e-3513-4bdb-8c25-b37717c5cccd/craig_bluetooth_tower_speaker_manual_cht884.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • https://savannah.gnu.org/projects/freefont/In PDF document text
  • http://www.gnu.org/licenses/In PDF document text
  • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.