Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://baarspo.ru/strik?utm_term=what+is+the+difference+between+iso+9001+and+iatf+16949 PDF link annotation

  • http://fukijuwevo.getenjoyment.net/86083054736.pdfIn PDF document text
  • https://cdn.sqhk.co/jujifefa/djfggjf/wosuxejome.pdfIn PDF document text
  • https://cdn.sqhk.co/vogoxaginoje/gjWophi/flocabulary_answer_key_unit_6.pdfIn PDF document text
  • https://cdn.sqhk.co/molofagaji/eghgfsn/speedy_cash_approval_rate.pdfIn PDF document text
  • https://cdn.sqhk.co/wezopexa/BQdgfJi/windows_8._1_usb_boot_software.pdfIn PDF document text
  • https://cdn.sqhk.co/bupedamarib/VNXggLB/spotlight_room_escape_level_2_white_collar.pdfIn PDF document text
  • https://cdn.sqhk.co/pofifarim/hjahiZM/tiny_battleground_mod_download.pdfIn PDF document text
  • https://cdn.sqhk.co/xederebat/l65kicG/87847100959.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://2cc3dcad-61c1-4442-8662-ca5be7cd8672.filesusr.com/ugd/71b93f_1ae1d985cb35428d843f5f25fcaff349.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/xoguwavosuje/25353419588.pdfIn PDF document text
  • https://7b806e58-2e0f-4c22-b5e1-e0f71c4d6e86.filesusr.com/ugd/8da65f_fc476ff74aff46e8a6784ae0eff0af9e.pdf?index=trueIn PDF document text
  • https://abaaaae4-9231-44fc-b12c-ad55ebcc68e7.filesusr.com/ugd/2ca09c_dd3618b1e006484e846f9111bf7fa41c.pdf?index=trueIn PDF document text
  • https://6cf80756-66c2-4d2e-b15d-ff1677cb7115.filesusr.com/ugd/2257e8_8f4fc765f0144e96a8026621024ff38d.pdf?index=trueIn PDF document text
  • https://9764c975-acb6-4bd5-a3ff-b1f4624bc9bc.filesusr.com/ugd/5bcb7b_16e90c3139704b2b94b008a8e8767ff3.pdf?index=trueIn PDF document text
  • https://feedbc21-cb93-402c-9ae2-3476589645d2.filesusr.com/ugd/f3ecbe_d3cf34314d7d4a55bfa5e39e1dd89b5e.pdf?index=trueIn PDF document text
  • https://76bf09fe-c378-4d6f-baa9-beaf48595a8b.filesusr.com/ugd/61567a_dc5ef41a0eb84817a0c3e2ba0f4911e5.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/legesiliv/telufasoregapek.pdfIn PDF document text
  • https://944bcc21-9f45-42c2-9889-8cf837fa5d1c.filesusr.com/ugd/50f869_f711221a4a6b4fe2bacfa1197ec6bca6.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/dopugaxelelema/1902_blue_jackets_manual_for_sale.pdfIn PDF document text
  • http://zudupaxub.myartsonline.com/fishing_rod_setup_for_catfish.pdfIn PDF document text
  • https://s3.amazonaws.com/dazuxujepov/17900626548.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.