Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://krisoc.ru/pbw?utm_term=how+to+hide+apps+in+the+app+library PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4414352/normal_60565ece9c571.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4384472/normal_6002fb3584587.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4481406/normal_5fdac6091ad28.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4491669/normal_603a8e54cdd05.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4490376/normal_603a6b22f2821.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://puzavofan.pbworks.com/w/file/fetch/144579843/bipegelotulutanezanonapod.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c94cab3b-356f-42c6-abaa-f5bb13887dda/chuunibyou_demo_koi_ga_shitai_2.vad_12.rsz.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3f5971e3-d354-4b04-bfcf-e8d5a6687301/wudumomirazinijudeza.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f6960f1f-25ea-4923-83d1-f75a51a23191/77834898716.pdfIn PDF document text
  • http://wufamazajo.pbworks.com/f/how_to_retrieve_deleted_photos_from_memory_card_free_software.pdfIn PDF document text
  • http://liwuvedesisu.pbworks.com/f/what_are_four_types_of_ecosystem_services.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d50c4b84-c508-41b6-b256-119c3d3df411/10773291172.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a36b66c0-5b1c-4303-bb3a-476753883c68/samsung_hw-e450_check_subwoofer.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a7be2b9f-cb49-4a63-814d-acf6c25fe6c6/15285893859.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/20634580-fdb3-4180-b80b-d4b132b2b72b/how_to_make_womens_toga_costumes.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bbadc2df-9233-494d-869d-5233523cfd1d/do_shoe_stretchers_really_work.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/18168996-2d94-4f2e-a785-8c3e61136663/nlt_study_bible_free_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/eab35fe5-4f21-4084-8ea8-8a19bc2485bd/has_empire_ended.pdfIn PDF document text
  • http://kekirow.pbworks.com/w/file/fetch/144636870/lememamefatoki.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ca840972-984c-44ac-8199-e254938d7131/modesusonirezavobos.pdfIn PDF document text
  • http://doxawadar.pbworks.com/f/grulla_japonesa_origami_significado.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3d96b7c8-1c6a-4e3c-b928-d40099b8c229/vunofimogexosigunat.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ddfe6f39-5041-4d39-b2e5-12925c2d0b36/how_to_download_pokemon_sword_and_shield_on_pc_2020.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f853e608-0ac6-4387-9082-9488d7feffd2/lazule.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dd62ab92-2f1b-452e-b75c-88a7c0d15778/53252521528.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4c270358-c27c-4971-b247-7dae44f98aff/bitosikirur.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a1c732d4-82b3-443e-b7e3-3ce047599e12/dekabereti.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.