Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
  Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://bologen.ru/strik?utm_term=hp+deskjet+2620+wifi+driver PDF link annotation

  • https://butopejejix.weebly.com/uploads/1/3/2/8/132814220/9bd099103dc6.pdfIn PDF document text
  • https://figiroxofidun.weebly.com/uploads/1/3/0/7/130740151/f10d58921.pdfIn PDF document text
  • https://zobovakobazazu.weebly.com/uploads/1/3/4/3/134319401/1c0d25eb.pdfIn PDF document text
  • https://kekufekogaj.weebly.com/uploads/1/3/4/7/134768560/newumodugevezodu.pdfIn PDF document text
  • https://cdn.sqhk.co/ragejeli/hhkgghc/death_worms_survival_shooter_game.pdfIn PDF document text
  • https://cdn.sqhk.co/gabebutiz/ieDgdrG/vugidureleb.pdfIn PDF document text
  • https://rebumazezip.weebly.com/uploads/1/3/4/8/134860465/63564.pdfIn PDF document text
  • https://cdn.sqhk.co/rapavuse/Aibhggi/carmageddon_2_download_utorrent.pdfIn PDF document text
  • https://libotavod.weebly.com/uploads/1/3/0/8/130813055/lejoduxa.pdfIn PDF document text
  • https://pegupirorig.weebly.com/uploads/1/3/1/4/131406852/kafol_wasevoluruwugi.pdfIn PDF document text
  • https://rogenogenitel.weebly.com/uploads/1/3/4/3/134316557/e37fbcc3e870a.pdfIn PDF document text
  • http://pexukakadom.22web.org/85277687233.pdfIn PDF document text
  • https://cdn.sqhk.co/kupuvikadob/jgTigja/color_bump_3d_impossible_level.pdfIn PDF document text
  • https://kovafusage.weebly.com/uploads/1/3/4/3/134332296/bokegam.pdfIn PDF document text
  • http://tuzazigigub.iblogger.org/washing_stained_white_sheets.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://vuvodulewuxewe.epizy.com/adding_fractions_like_denominators_worksheet.pdfIn PDF document text
  • https://8964868a-aef6-4da0-9a9b-29de7c28e0c5.filesusr.com/ugd/b910ae_5353f6db448545859877dbc85e2704fe.pdf?index=trueIn PDF document text
  • https://d90bda3b-35dd-409f-9d4b-b4a00d881a52.filesusr.com/ugd/b88e3d_0eae349a6b7c4d98bc4b87aba69079ff.pdf?index=trueIn PDF document text
  • http://fefirujo.rf.gd/oreck_xl_vacuum_belt_walmart.pdfIn PDF document text
  • https://5405d108-7f1e-482b-a10c-e06f62b7505d.filesusr.com/ugd/d941b1_6c81f687acc44a2abf79613290f5b0ef.pdf?index=trueIn PDF document text
  • https://cf4de027-7369-46c2-bf93-d69cabef2b5e.filesusr.com/ugd/868b90_3a2203418e784f07afb7475a188b6d67.pdf?index=trueIn PDF document text
  • https://0108a07e-94d6-443d-bfa7-575dd38852ad.filesusr.com/ugd/756a01_b0ad4e89d5e543538cdb8f602f212a7d.pdf?index=trueIn PDF document text
  • https://45ae50e1-98a8-4501-9ad6-fc0df438eb43.filesusr.com/ugd/b16523_0403a5471fde4611969bd9fb4ae6bfd0.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.