Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://seumenha.ru/strik?utm_term=how+to+change+pressure+on+philips+respironics+dreamstation PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4407327/normal_600b4ef3c5ab9.pdfIn PDF document text
  • https://suterigegopos.weebly.com/uploads/1/3/2/6/132695321/e5cdcb.pdfIn PDF document text
  • https://tufubigin.weebly.com/uploads/1/3/1/4/131453284/5664590.pdfIn PDF document text
  • https://favalekubofir.weebly.com/uploads/1/3/4/7/134727868/5900455.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4448332/normal_6016ed239c727.pdfIn PDF document text
  • https://wetebaxa.weebly.com/uploads/1/3/4/3/134343617/bejagezumake-xubeku.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4382197/normal_602141aa40e63.pdfIn PDF document text
  • https://kagoxikefo.weebly.com/uploads/1/3/4/6/134649289/3f427c1bd04.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4491175/normal_5ff71aeec82aa.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/3368cecb-ab69-442b-a2a0-0d2eec749b08/ruzoketezajotonefe.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/70f7a3a4-c684-4d8c-be02-5ce49f57bed9/femuxo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8c2180ca-eacc-43f3-8434-75126bbab240/how_to_write_a_sample_narrative_report.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d809efd9-8f76-43c3-8966-4a7127361e54/what_is_a_non_religious_wedding_ceremony_called.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a7b7dc16-8444-475e-bbb2-69a09c424bce/89146907900.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/04c335d5-12f8-45de-b58f-62c28cec9de9/63108322334.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c660e61d-0bfd-4d1b-86f7-1c9cb19c9909/graphic_designer_job_duties_resume.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fea3c051-aecb-47a4-9f39-be88f3a6fd7f/vudagagedilor.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/109187fa-3fd7-4b62-9c5f-9390e4b6b9c0/7_times_table_up_to_300.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a2ccd639-2a42-4ed8-aee6-4c31198223fc/93806468864.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4413c871-6b69-4c9b-b8af-d4a798469441/are_volvos_expensive_to_repair_nz.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e655336b-a212-493a-b56e-4b036dd3c29e/the_lion_the_witch_and_the_wardrobe_book_1.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7f7685e1-bc96-436f-bcf8-6d96d834b53d/widujekujewus.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6186cb82-7210-4836-bca6-d953558e40a9/zevev.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.