Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://kuzutuzo.ru/strik?utm_term=very+good+in+spanish+crossword PDF link annotation

  • http://lexukugeru.22web.org/11281721251.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4496148/normal_60205258e8eda.pdfIn PDF document text
  • https://weralafopibobal.weebly.com/uploads/1/3/4/3/134338927/ba0e4.pdfIn PDF document text
  • http://fogepadive.iblogger.org/asylum_2005_movie_free.pdfIn PDF document text
  • http://mosenub.22web.org/cantico_delle_creature_testo_e_parafrasi.pdfIn PDF document text
  • https://leludexubivavij.weebly.com/uploads/1/3/1/8/131860378/dejepodezi_zogotov_darabuwebegozug_pubugaderegudo.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4425009/normal_602ab899c33eb.pdfIn PDF document text
  • https://titezexi.weebly.com/uploads/1/3/4/6/134639754/7049032.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4377371/normal_6020a5dec1c26.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4456984/normal_602bb2d2303b0.pdfIn PDF document text
  • https://vunisanelebori.weebly.com/uploads/1/3/3/9/133999195/doxisoriz-surelifowave-bugaxapal-xefava.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://3dcfbd4a-ef33-49dc-a04a-0aaf5307c30d.filesusr.com/ugd/b47706_30e8d399cee14b48a23b50b768020df8.pdf?index=trueIn PDF document text
  • http://zodiripek.myartsonline.com/bujoziranutum.pdfIn PDF document text
  • https://53ebb62d-ddaf-432f-8dc3-1f4746653467.filesusr.com/ugd/bbd3cf_5f1cdf4288bc43649df66e3e2414cf87.pdf?index=trueIn PDF document text
  • http://kakasis.onlinewebshop.net/79968201279.pdfIn PDF document text
  • https://1a9cd40a-f0d6-44d4-a143-19288280ca2b.filesusr.com/ugd/7a13df_919b30c45d434128ab01f127ead5f3f4.pdf?index=trueIn PDF document text
  • https://ecf8b3bd-8201-449f-a39c-156acd88681e.filesusr.com/ugd/97634b_f491ae7cc7ce48d7a9e7a03a22eacd28.pdf?index=trueIn PDF document text
  • https://03df18d0-0a94-4077-8b44-1f3cf8b7c870.filesusr.com/ugd/23a6c3_b3d55f260cd7477cb0a047d8733aa384.pdf?index=trueIn PDF document text
  • https://2a4065d7-883d-43e8-a524-7ce9aa4b4e88.filesusr.com/ugd/ccb1c6_02432fa3a844459691a783b94cb98374.pdf?index=trueIn PDF document text
  • http://lizaduguxo.epizy.com/20521343038.pdfIn PDF document text
  • http://sajulugebimisu.myartsonline.com/how_do_i_access_wd_my_cloud_from_windows_10.pdfIn PDF document text
  • http://wawukekaxemiju.epizy.com/37304357793.pdfIn PDF document text
  • https://b00f38ea-0d13-4519-ab0f-1253f0d03ca0.filesusr.com/ugd/289c5e_4494d49d9a7d4c0ab6e2c14d8c9e59ea.pdf?index=trueIn PDF document text
  • https://f9c81679-ddb1-4746-ab40-32673edc426c.filesusr.com/ugd/2eff39_0643365972b043419ee385f2ed0b1ff6.pdf?index=trueIn PDF document text
  • https://7133fc40-0b9c-4701-b953-e7fafc934b44.filesusr.com/ugd/70a38d_084e5b4cd96446e3b0ecae90a0d6652a.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.