Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dugedepap.ru/award?keyword=a+song+of+ice+and+fire+tabletop+miniatures+game+rulebook+pdf PDF link annotation

  • https://kovorugoza.weebly.com/uploads/1/3/1/3/131383314/bakewujakerikugiwamo.pdfIn PDF document text
  • https://cdn.sqhk.co/wodelaganav/tjaqjdv/34133532930.pdfIn PDF document text
  • https://cdn.sqhk.co/liminekaj/hRifgiZ/free_ringtones_for_iphone_8_plus_without_itunes.pdfIn PDF document text
  • https://cdn.sqhk.co/kinifukix/bHjfxpy/megan_thee_stallion_songs_youtube.pdfIn PDF document text
  • https://fixuvanexe.weebly.com/uploads/1/3/4/3/134359444/810fef31e01.pdfIn PDF document text
  • https://mijezuri.weebly.com/uploads/1/3/0/9/130969422/pojusagewumedonabupo.pdfIn PDF document text
  • https://cdn.sqhk.co/fevivesuxofo/0ibMidB/vavuvagolenux.pdfIn PDF document text
  • https://xofofafe.weebly.com/uploads/1/3/1/4/131438501/1191d16eb.pdfIn PDF document text
  • https://dutajidadu.weebly.com/uploads/1/3/4/7/134730474/6866541.pdfIn PDF document text
  • https://cdn.sqhk.co/tononapiwaso/iagfhd8/lomenusuregitok.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/20d84f86-d92c-4ea6-89bc-dced8dc2d547/amcor_portable_air_conditioner_kf9000e_parts.pdfIn PDF document text
  • https://160e4e15-e27a-4ef2-9b26-f67fc0969a86.filesusr.com/ugd/cbdbb6_e9f06d352f5749698754ac64f4a8f46d.pdf?index=trueIn PDF document text
  • https://30cc9e9c-6145-4029-bfdc-d0561bdb3a10.filesusr.com/ugd/0dcf4b_7c8c34d75b9247eba8be373e95421641.pdf?index=trueIn PDF document text
  • https://a1d1c4ac-cf1d-4c58-861c-45d1188f4b60.filesusr.com/ugd/052f3a_5ba23d40e3ff46d7ab110608eae54bbf.pdf?index=trueIn PDF document text
  • https://1e1f235d-56dd-4976-b20d-d38e3fe7b172.filesusr.com/ugd/210b45_93688ce9cfa646adbeb031997f73666b.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/6e1b528d-51be-4063-b456-b95987993000/will_a_fully_unlocked_phone_work_with_straight_talk.pdfIn PDF document text
  • https://98748e4b-3258-471a-903e-8ea98415cca0.filesusr.com/ugd/fd7405_e39d23bfaa8a4874b6b3a713c01ea1b2.pdf?index=trueIn PDF document text
  • https://c81c1a69-aec6-471c-ac34-7a6800eafc69.filesusr.com/ugd/9ef1ea_e27194cfd1fe48d2926b42c8566580f8.pdf?index=trueIn PDF document text
  • https://30621b86-6952-4b41-80af-4d24d830bc7c.filesusr.com/ugd/122077_4354ea7a1ac646c08646c4d14fab172c.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/7537cc5f-b042-4823-95a3-ba127ad416dd/45062172848.pdfIn PDF document text
  • https://064d663d-f6b2-44cf-a6ad-083da5f315e5.filesusr.com/ugd/77eba6_0837c2dc3a52403f8f7d774b10174e7f.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/f3590c1a-5f78-4fa2-a7c5-031421d50058/dna_rna_and_snorks_drawing.pdfIn PDF document text
  • https://26f2e344-8444-46ea-90c9-5a893bcc2fb3.filesusr.com/ugd/b8c837_e63d34470fa24ba88de9fd69f29edf22.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/6e6b5a30-1764-491e-97a1-8fd377f7b777/11919744888.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/093b53ec-8fda-433c-8ae9-0859c7e496d8/17944768432.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c06a79f1-11dd-4880-9598-4c137f047287/nodiz.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.