Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://midufefew.ru/strik?utm_term=weber+18+charcoal+grill+home+depot PDF link annotation

  • https://cdn.sqhk.co/ruxuzobisu/igifihk/mad_bullets_mod_apk_download.pdfIn PDF document text
  • https://cdn.sqhk.co/dawadetugas/mhdvTcr/ninja_village_one_punch_man.pdfIn PDF document text
  • https://cdn.sqhk.co/gasubapo/fghmgjR/87048368103.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/gajakelegeza/neato_robotics_botvac_d7_connected_saugroboter_d701.pdfIn PDF document text
  • https://6680615c-3592-42a6-94f3-b98e474b5330.filesusr.com/ugd/252546_63e9815cd2b84de3ae051c03d10967b4.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/guxosa/log_into_stars_nycdoe.pdfIn PDF document text
  • https://d115d978-d96a-40c8-9764-5d959708fc35.filesusr.com/ugd/436160_52c48a2e1d9d49e9a3b8b1de0c364ea4.pdf?index=trueIn PDF document text
  • https://92fed17e-af34-466b-b3fe-38cd9ef27699.filesusr.com/ugd/192d58_bda56df6bbf541caa32ad9b62a381a98.pdf?index=trueIn PDF document text
  • http://zorogeloma.epizy.com/53381274446.pdfIn PDF document text
  • https://a43ab9c2-5efb-4cee-ac06-b782a0f5e207.filesusr.com/ugd/4826f5_61dddfca0a5e4968831033b0e4ed34b4.pdf?index=trueIn PDF document text
  • https://9cfe8934-cc69-4f76-a0d0-2e9849ea4530.filesusr.com/ugd/fd9558_7d26cef5ef934aa8a42b18ee448f3807.pdf?index=trueIn PDF document text
  • https://b6e49935-6d58-4bde-831f-6e0b746776d3.filesusr.com/ugd/7d321f_e5f44c5719bd445f9613b29f8b5f5698.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/purufiz/2006_chevy_equinox_for_sale_ontario.pdfIn PDF document text
  • https://s3.amazonaws.com/kozibowisenatu/2005_jeep_grand_cherokee_limited_5.7_hemi_towing_capacity.pdfIn PDF document text
  • https://s3.amazonaws.com/toguvaju/best_paint_color_for_formal_dining_room.pdfIn PDF document text
  • https://s3.amazonaws.com/wizedumi/surf_report_coronado_beach_california.pdfIn PDF document text
  • https://s3.amazonaws.com/megelugik/tirijoko.pdfIn PDF document text
  • http://jizozekawa.epizy.com/jupesemagisusujug.pdfIn PDF document text
  • http://wagesasalep.rf.gd/the_girl_with_the_dragon_tattoo_2011_ending_explained.pdfIn PDF document text
  • https://a21f0d7d-5fe0-4a99-a381-3b18266e0880.filesusr.com/ugd/6c313a_b68861a473834d7188c573b055ff6a46.pdf?index=trueIn PDF document text
  • https://4bf641bf-117a-4913-931f-55e49063997f.filesusr.com/ugd/5befcb_7adaf415b9194c8dad0feee6aa0ab81a.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/rujabepifar/wavefront_obj_file_format_specification.pdfIn PDF document text
  • https://c78ffd2e-fc3d-4272-86ca-968d835fb7ad.filesusr.com/ugd/0f9ef0_88cfa86a03324f5f96675da5586d6813.pdf?index=trueIn PDF document text
  • https://f3b8d348-8566-49c9-a9f8-a2c3b9e1bc8e.filesusr.com/ugd/f1c748_daf3f0ff72df4856809691e07be05545.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.