Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jottigo.ru/wix?keyword=football+manager+2017+apk+mod+money PDF link annotation

  • https://cdn.sqhk.co/bedogipaxog/cig2qPx/railway_crossing_warning_sign.pdfIn PDF document text
  • https://cdn.sqhk.co/dutaxato/hh5Rigi/jowirudegokekep.pdfIn PDF document text
  • https://cdn.sqhk.co/tinolaseja/dVhaDja/fanemefurimaxisosus.pdfIn PDF document text
  • https://cdn.sqhk.co/riwifesineji/jjcvNpz/modixexoxiwedavato.pdfIn PDF document text
  • https://cdn.sqhk.co/kawinojos/eicOaBI/53617063533.pdfIn PDF document text
  • https://cdn.sqhk.co/telazaje/7JicHha/hakuouki_anime_episode_1_english_sub.pdfIn PDF document text
  • https://cdn.sqhk.co/lowilufape/4YZNpD7/97586413739.pdfIn PDF document text
  • https://cdn.sqhk.co/kifukuvitog/JhhObjh/32938849478.pdfIn PDF document text
  • https://cdn.sqhk.co/madumubo/ddr59ZJ/73362503074.pdfIn PDF document text
  • https://cdn.sqhk.co/pozedezupase/iOzicja/chote_raja_song_raagsong.pdfIn PDF document text
  • https://cdn.sqhk.co/wularumijif/aAjfigZ/1731014022.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://73e25548-3913-4bbb-aa69-a1b25f69568d.filesusr.com/ugd/cece23_49d8d2746b8a413085b4fab67b0544b2.pdf?index=trueIn PDF document text
  • https://13adc596-845f-4f4a-b539-e2c04a0a4b5a.filesusr.com/ugd/6e2da7_7853b16f3a784f59b8c817b05f63a8d7.pdf?index=trueIn PDF document text
  • https://26577e91-18e8-42c3-8e85-49dcca1d6605.filesusr.com/ugd/195787_d438c398dbe14fc696c5b2f9c1bfa46b.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/b07a6fd9-ec81-43d0-a60c-92cc5fe84487/bomozowanuganonux.pdfIn PDF document text
  • https://0306adf0-382e-42f1-903d-71c3961c97f1.filesusr.com/ugd/7ff653_fe9b9add1d74402f9c5accef634e8b91.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/14981056-6bcb-4142-886f-6dbbdd4208f3/19129880226.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/548e9c4a-daae-4d6a-b542-622c1943279b/litojijap.pdfIn PDF document text
  • https://7f1158f2-e44e-4cac-991a-806210d1dc3e.filesusr.com/ugd/e4a8e1_2347a254c62d469babc07bd31c6c1d08.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/f2055a92-46b2-43a8-97fb-dc318afd3dd5/lurabubademidalem.pdfIn PDF document text
  • https://aa5f33e9-793b-4807-a257-9eac84d314d0.filesusr.com/ugd/aa57b2_b6ca3252a62845739cb71bff6ccd251b.pdf?index=trueIn PDF document text
  • https://76bf09fe-c378-4d6f-baa9-beaf48595a8b.filesusr.com/ugd/61567a_b56ea941ce914b49be7bfc909697b291.pdf?index=trueIn PDF document text
  • https://3e1ae61b-6b68-46dc-8a90-d1c7a5b9f91c.filesusr.com/ugd/b8bbd7_6d9d0ef04b48472caa4c9e30ddf0c15a.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/3c95b8bf-3358-4981-a2c7-63eb49408c98/79273824070.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.