Malicious PDF — malware analysis report

Heuristics 8

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
  Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
• Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
  Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://botokaw.ru/strik?utm_term=asus+z87+pro+nvme+bios PDF link annotation

  • http://nupifijaw.getenjoyment.net/ruet_admission_circular_2020_20.pdfIn PDF document text
  • http://jajuviramigawo.medianewsonline.com/41608214943.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4374517/normal_6034318ee920f.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4493867/normal_604fec40c6cdf.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4412170/normal_5ffa5d7a3f4ef.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://c7f0abc7-d23b-482d-bd16-0771495bb668.filesusr.com/ugd/bb13a2_e40863790a0f4b3c9b6339640c4716f0.pdf?index=trueIn PDF document text
  • https://4ad55601-b8ab-4ae0-bc0e-e90069072326.filesusr.com/ugd/3aca14_efc31ff85d5b4982a2c7e79c2d52bb6a.pdf?index=trueIn PDF document text
  • https://4cd5a77a-be8d-44ba-8952-4177873115c4.filesusr.com/ugd/930050_40a4ae70294c485e832a1703467757cf.pdf?index=trueIn PDF document text
  • https://69cf8a46-0d3d-4b71-8fd1-93df925da18e.filesusr.com/ugd/e4064d_c5d13cdbc0c34470a0f30a6dfe80d940.pdf?index=trueIn PDF document text
  • https://203aa715-7352-46b1-b16b-5d0aeeaa27a2.filesusr.com/ugd/0582e0_c3b761d78aea43f087d1fa2616228114.pdf?index=trueIn PDF document text
  • http://jajunegetilu.rf.gd/14696362506.pdfIn PDF document text
  • https://44bb6ee8-a0fe-4f72-890f-0f0a2fec05cf.filesusr.com/ugd/b65acf_c681c978a2bd4a2a8d8881fa81f969de.pdf?index=trueIn PDF document text
  • http://fomobiwudaz.rf.gd/91665206614.pdfIn PDF document text
  • https://6363ce23-9394-4102-a476-7be320345719.filesusr.com/ugd/7c41c1_966387500cc545fab5195b1365ffa159.pdf?index=trueIn PDF document text
  • https://e49cd12a-7e53-4a25-9f98-ae37b5ff2e44.filesusr.com/ugd/35dc59_ea56c5d55a2c4b6390ee24197b99f3c8.pdf?index=trueIn PDF document text
  • https://c4fca8c4-0f54-45c3-ae88-320069d86c16.filesusr.com/ugd/ac0d21_49e8479be2af497e81c129385e1e0f74.pdf?index=trueIn PDF document text
  • https://ecf8b3bd-8201-449f-a39c-156acd88681e.filesusr.com/ugd/97634b_40971955d0ba4d99ba1cad1cefd218d1.pdf?index=trueIn PDF document text
  • https://0a3c8164-ddd9-4522-8472-457ce31ece15.filesusr.com/ugd/d32f78_cc582a12b1aa4e6bbdb91aabcf4d15cb.pdf?index=trueIn PDF document text
  • https://9505ca4c-dfdc-4941-8fde-ded35496d0c9.filesusr.com/ugd/2097ab_5bf18d4ccece44c39bc6226218569c0b.pdf?index=trueIn PDF document text
  • https://88bec3ce-9cdd-4818-a95b-bcf8ac49d1e7.filesusr.com/ugd/72df48_355770c5c512453eb66e595d6146b327.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.