Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
  Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://nipisod.ru/wix?keyword=surface+area+and+volume+of+similar+solids+worksheet PDF link annotation

  • http://cardio-natural.info/facebook_business_page_help_chatm9z76.pdfIn PDF document text
  • https://jenejipita.weebly.com/uploads/1/3/4/4/134473981/125456cfb20.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4495385/normal_5fc79ff09bc29.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4368504/normal_60491b1202cd3.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366659/normal_6020a837876b7.pdfIn PDF document text
  • http://my-favshopd.online/29139591173r348k.pdfIn PDF document text
  • http://testvvd.xyz/forecasted_budget_templatec2hz8.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4390071/normal_5fc5c4ef0f1be.pdfIn PDF document text
  • http://damita.fun/how_to_use_a_curling_iron_for_beginners8927n.pdfIn PDF document text
  • http://sallles.ru/karumozu1v0n0.pdfIn PDF document text
  • https://revuduxaj.weebly.com/uploads/1/3/5/3/135333309/9211465.pdfIn macro / runtime command snippet
  • http://sallles.ru/karumoIn macro / runtime command snippet
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/8ef61832-5e99-4a28-afde-0006690aacb2/masukumuniremiwidi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c875a487-1020-404c-9df2-dc0649ad377c/freedman_pisani_purves_statistics_4th_ed._w._w._norton_2007.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8332fe31-dc91-4e39-9712-73c4be963ae3/what_should_my_honeywell_humidifier_be_set_at.pdfIn PDF document text
  • https://21e323bd-7fdd-46e9-a6c7-4880e76d7610.filesusr.com/ugd/0a51c1_67e21408d62549e7a7e5790fdab66177.pdf?index=trueIn PDF document text
  • https://ec75ba9f-29a7-4b73-bb51-4c951d20089f.filesusr.com/ugd/17cde0_016892d9f593450d9380b04c5a8e941d.pdf?index=trueIn PDF document text
  • https://11ab4cf5-156d-4417-99e9-5039b2a7eb5f.filesusr.com/ugd/82d61e_4392a01be46b461e9f0acdb0b3d36911.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/47718dd2-8450-42ec-942c-e251defd6ae4/what_are_the_conventions_of_detective_literature.pdfIn PDF document text
  • https://200ee3fc-349d-4871-b5c3-2c1c69b60476.filesusr.com/ugd/7b00a0_3ff14f2ca3f64755b4f5ec0cb89711ee.pdf?index=trueIn PDF document text
  • https://f499a9ea-5579-4d3c-a180-ba191067f9b7.filesusr.com/ugd/34ec99_3f850db2faa042d7b41036159d3ad23f.pdf?index=trueIn PDF document text
  • https://26577e91-18e8-42c3-8e85-49dcca1d6605.filesusr.com/ugd/195787_43d9267b5eac4f729ed4b7bedd812b79.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/838ff062-3999-4bfc-8ff9-da2b875cbcc9/master_forge_grill_burner_parts.pdfIn PDF document text
  • https://f7cac2f2-528f-490f-9bef-cb2448a877de.filesusr.com/ugd/529ba0_983756f550ec4195a407b364ac9b1571.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.