Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
  Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dafemum.ru/wix?keyword=ib+written+assignment+cover+page PDF link annotation

  • http://gonzo-3d.com/99360952622tdibw.pdfIn PDF document text
  • http://helps-lnstagramcopyrights-about.com/what_does_s_curl_do_to_your_hairx4k7s.pdfIn PDF document text
  • http://delayikapy.xyz/insulation_jacketing_sheetrlh1s.pdfIn PDF document text
  • https://cdn.sqhk.co/jobubexivex/N3GMchh/vavevibomowiwokujeweri.pdfIn macro / runtime command snippet
  • http://okclub.org/50288173168bc0qr.pdfIn macro / runtime command snippet
  • http://copyrights-notices-helps.com/witcher_3_complete_walkthroughpi2jo.pdfIn PDF document text
  • https://cdn.sqhk.co/gixelotopa/wifLgd0/55399360566.pdfIn PDF document text
  • https://cdn.sqhk.co/teposodigar/jcggYif/world_truck_driving_simulator_game_download.pdfIn PDF document text
  • http://fullcreditreport.info/suzuki_sidekick_for_sale_coloradoyg835.pdfIn PDF document text
  • https://cdn.sqhk.co/nulaliki/qhjjdCf/how_to_use_soft_spiral_rollers.pdfIn PDF document text
  • https://cdn.sqhk.co/naziwixolagu/hvxhcgi/doodle_god_rocket_scientist.pdfIn PDF document text
  • https://cdn.sqhk.co/nobixapo/c7giuho/last_player_survival_battleground_apk_download.pdfIn PDF document text
  • https://cdn.sqhk.co/xipitufekaru/byvjjjf/followers_and_unfollowers_for_instagram_app_download.pdfIn PDF document text
  • http://websporizle4.com/fifty_shades_darker_movie_download_720p_dual_audiottldg.pdfIn PDF document text
  • http://lightstart.xyz/xadadodukefysl0n.pdfIn PDF document text
  • https://cdn.sqhk.co/rirelolut/bulzT9f/49046425383.pdfIn PDF document text
  • http://leree6.club/lufenilesopidevu1qxgb.pdfIn PDF document text
  • https://cdn.sqhk.co/jenuluvonuz/aiaidjj/zedasowaj.pdfIn PDF document text
  • https://cdn.sqhk.co/nubavojek/rn1Aqge/dixevobipamutekifatoxula.pdfIn PDF document text
  • http://redpandarecycling.com/kamen_rider_city_wars_apk_mod_moneyl6wtg.pdfIn PDF document text
  • http://help-feedback-amzn3.xyz/simple_diy_cardboard_cat_houseyr6ux.pdfIn PDF document text
  • http://delayikapy.xyz/insulatiIn macro / runtime command snippet
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://6997f972-013f-4c6f-ac95-4179ba17a557.filesusr.com/ugd/549e1a_aca1c6ee7b9b479a95c7738d0969d7e9.pdf?index=trueIn PDF document text
  • https://3f054cde-0430-4828-89d0-5f77035cf230.filesusr.com/ugd/d93890_c0fef7f31d2940bca56b48c4dedda65a.pdf?index=trueIn PDF document text
  • https://7fc1e5b2-1dd8-4457-9de2-3dea1ab9f589.filesusr.com/ugd/fedd61_b5f6429ffc17401593b5e117405d9392.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.