Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
  Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://midufefew.ru/strik?utm_term=netgear+wn1000rp+factory+reset PDF link annotation

  • http://rusadezebep.mygamesonline.org/how_many_chapters_are_in_chronicle_of_a_death_foretold.pdfIn PDF document text
  • http://nipokaxa.getenjoyment.net/how_to_reset_a_whirlpool_washer_front_load.pdfIn PDF document text
  • http://tupaxeguna.scienceontheweb.net/how_to_access_my_cloud_mirror.pdfIn PDF document text
  • http://muvepifare.mygamesonline.org/mafaretatag.pdfIn PDF document text
  • http://zupejuxe.iblogger.org/rizafu.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://f7e05ffc-afae-4d19-be15-7e9c659e5e5f.filesusr.com/ugd/72f62b_1b4021ad196647d79ad72f839164d609.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/4b82d277-eb42-40c0-9031-341e0ce22073/vimadetofubujivesiwes.pdfIn PDF document text
  • http://memajale.epizy.com/45041025267.pdfIn PDF document text
  • https://1423d76f-a56f-4481-bf87-726e17039346.filesusr.com/ugd/14aee2_79c031b8b1d84012b12fd4dd8b65b470.pdf?index=trueIn PDF document text
  • https://1ac5d900-0c69-4f12-8b1d-4e209472b8d2.filesusr.com/ugd/828753_dbf82191003243bda119fa200fced8d4.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/644dffda-da91-4bbc-bc08-dc47c82451ad/masuluxo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/792b1bfb-b43f-4c0d-b9d6-42a802bdc95f/what_is_the_best_topic_for_couples.pdfIn PDF document text
  • https://bef89f6e-6323-4b84-ad9d-a44490bfcc4f.filesusr.com/ugd/96768c_eb1d225fac3642008d48d0aa6df23672.pdf?index=trueIn PDF document text
  • http://lagadasisipas.rf.gd/50325403574.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cf191d6d-bca3-4a21-93ec-b6e6a12de853/dmv_audio_driving_test_ny.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c2947510-9b3a-46f9-996c-b56775f8fb24/27275623325.pdfIn PDF document text
  • https://da89e6ec-52f9-4c28-8de8-447a2e923c0c.filesusr.com/ugd/5e5b2a_5b8ee9eb643345ba8154533f9bb9f2d3.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/e6749c43-b643-44d5-a684-88b57afc49b8/28277846473.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c28d6980-9332-423d-aaef-1cb383ea1676/harry_potter_and_the_half_blood_prince_ps2_game_download.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.