Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jacksth.ru/strik?utm_term=who+is+the+stock+character+in+thank+you+ma%2527am PDF link annotation

  • https://roxuxafuz.weebly.com/uploads/1/3/0/8/130813852/6422c573207c.pdfIn PDF document text
  • https://wotowabe.weebly.com/uploads/1/3/4/6/134688823/jawumozod.pdfIn PDF document text
  • https://bavejojonosepes.weebly.com/uploads/1/3/1/3/131380601/sepiwojokanusim.pdfIn PDF document text
  • https://xizavuxovom.weebly.com/uploads/1/3/3/9/133986710/9116534.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://17673d3b-e5d0-4e0e-8211-f079fadf35f5.filesusr.com/ugd/13ae68_2c3b377c6ca547eda5eac63bb86f67e1.pdf?index=trueIn PDF document text
  • https://feedbc21-cb93-402c-9ae2-3476589645d2.filesusr.com/ugd/f3ecbe_433b29c170c347ae870669feb929d1e8.pdf?index=trueIn PDF document text
  • https://ab60d57a-1f92-408f-9079-0b325776b613.filesusr.com/ugd/724fb5_e303801f199c4227831b4aeb6502b808.pdf?index=trueIn PDF document text
  • https://9ef77391-fdd1-48d8-ba15-364b07375333.filesusr.com/ugd/ebefdf_3af17f6ef26244a681175367a2d5778a.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/lekezaru/wenaselunukozape.pdfIn PDF document text
  • https://b1b0174c-961c-4936-87f6-765e1132391e.filesusr.com/ugd/6cf804_a3be3bb602c24be1b871aa8a03795387.pdf?index=trueIn PDF document text
  • https://9de673a2-3b8e-40eb-bbf5-c0ad8e71a3da.filesusr.com/ugd/bd5c68_e6da3ee3e5bb4992a664885f2a3052a9.pdf?index=trueIn PDF document text
  • https://d52aed46-be45-4f9b-8106-cf6fc7ee66c0.filesusr.com/ugd/b148e5_68abb7d8117b4557a4c83bbc5f698a80.pdf?index=trueIn PDF document text
  • https://4bf641bf-117a-4913-931f-55e49063997f.filesusr.com/ugd/5befcb_02783a1a00c549378963a27d2c75cc7d.pdf?index=trueIn PDF document text
  • https://30c74dc1-c3f2-4e71-8253-1ec84f3b94e1.filesusr.com/ugd/b8c6fa_c013f93f4caa45189e53c656470945f7.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/mukut/fountain_lake_albert_lea_fishing_report.pdfIn PDF document text
  • https://d5fd0048-bb8d-45a1-ba21-28d1cb0b7162.filesusr.com/ugd/5e8de6_8c18c4522b9e4d448ce5586d5143c21e.pdf?index=trueIn PDF document text
  • https://45e41439-46a4-4c97-84f0-155cfeda4cef.filesusr.com/ugd/9d7ad9_db14898aa9e842c9882fce2d3a42199d.pdf?index=trueIn PDF document text
  • https://c4a5d104-04f9-44e6-b03f-1f5edac3680f.filesusr.com/ugd/f23921_be869137c77940179e9d8f6fe683c7ac.pdf?index=trueIn PDF document text
  • https://15319a82-8c66-4906-b3c2-464277991f2b.filesusr.com/ugd/070acf_05fcacd03fb847e483d353d7e7093d43.pdf?index=trueIn PDF document text
  • https://4328a374-8b5c-4134-9cef-e132ca5fc89d.filesusr.com/ugd/6732b1_42dc476a5b9840fcb4ce60f26ae8cbd0.pdf?index=trueIn PDF document text
  • https://eee5dff6-7331-416e-acdf-593d0c386862.filesusr.com/ugd/21e9e0_b720180ebc374c378486e2a7ff4365ec.pdf?index=trueIn PDF document text
  • https://5e73d190-47a4-4ead-99bf-7e9069f06a16.filesusr.com/ugd/55cc32_ca709237c95a45a3aca036130bcfceb2.pdf?index=trueIn PDF document text
  • https://43cb2d18-1589-43a7-b1c5-fe1278e1c76d.filesusr.com/ugd/370b54_a01a6c10e81f48fc8441e87629291287.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.