Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://golowaki.ru/award?keyword=francis+bacon+essays+pdf+download PDF link annotation

  • https://cdn.sqhk.co/tikexumivu/NJhdLhf/kalakalappu_siva_template.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4420597/normal_6025bb0bd088e.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4369174/normal_5fc85f89bf05e.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4489414/normal_6004d4e5b6498.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4375355/normal_5fdb2b3359707.pdfIn PDF document text
  • https://cdn.sqhk.co/dizirajeb/hLUjchj/gexej.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4378608/normal_5fe1c2ed70961.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4368245/normal_5fd66e972cdcb.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4470543/normal_5fd3a44982e32.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4365606/normal_5fcce46a6bd81.pdfIn PDF document text
  • https://cdn.sqhk.co/pesegozod/ygg54jl/towajokagepakuv.pdfIn PDF document text
  • https://cdn.sqhk.co/bawusipa/7oEkkMj/38199150760.pdfIn PDF document text
  • https://cdn.sqhk.co/jurufovowufu/bP5hb9a/vector_despicable_me_direction_and_magnitude_gif.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4499635/normal_600b202ddacdc.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/fbed6f4a-3021-4544-84a5-a7f6326cdb1f/nekoribifudetojazesijizuj.pdfIn PDF document text
  • https://636e06b3-920c-4898-b827-ef778bbbc101.filesusr.com/ugd/40512e_ac6eb78d082b41258b4eaa3850064954.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/af00ab54-c98e-4822-ba73-32f426a80481/guzitebak.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6f553e93-bea0-4351-8225-9aa0be6cdb3f/xunogixu.pdfIn PDF document text
  • https://d8acad56-eb9a-42d1-a06c-a695c5b02328.filesusr.com/ugd/0ad6c7_5c7d4162a56d48ea9d8917152db5c340.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/508a6fcd-048d-46b1-9bd9-cdd7c22ee566/tolezosinumujerewedopul.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3397d125-57db-4414-be85-622d8d134c47/viper_7153v_remote_programming.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0affa7a3-644b-4827-a171-b2fb09bc66cc/pegelojavi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0ef8da5a-7a64-41fe-bda4-2f638100e2a9/mitomudatixuwuvipavude.pdfIn PDF document text
  • https://6f1239e7-da96-47bf-8adb-22d47a96a9da.filesusr.com/ugd/bb5a15_1daa3aa6bc454eec810f8aaecdbeaf35.pdf?index=trueIn PDF document text
  • https://f770b3d7-c897-40e0-9323-5ad0abd91552.filesusr.com/ugd/1fa6dd_1cf4d365d66c4177b052741c2f04431c.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/5a309401-2a0d-4f27-828d-58c7591f8d22/92689177362.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a97d60e2-5ada-49fe-9e73-86039d2b1423/whats_coming_to_netflix_in_august_2020.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.