Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://midufefew.ru/strik?utm_term=2000+ford+f250+super+duty+transmission+cooler+lines PDF link annotation

  • https://cdn.sqhk.co/diwiporeb/UhjfOjh/gukefadirujovizu.pdfIn PDF document text
  • http://nopowajowopu.iblogger.org/38404823836.pdfIn PDF document text
  • https://cdn.sqhk.co/rudixika/Jbgiges/bubble_pop_hyuna_lyrics_english.pdfIn PDF document text
  • https://cdn.sqhk.co/lusoxepero/4LGiege/56337490450.pdfIn PDF document text
  • https://cdn.sqhk.co/wibezudak/jD9Jdkf/hot_wheels_infinite_loop_pc.pdfIn PDF document text
  • https://cdn.sqhk.co/femokuxajuz/Thaicge/62989175125.pdfIn PDF document text
  • https://cdn.sqhk.co/sugezigo/hhiRUgj/racing_fever_moto_unlimited_money_and_gems.pdfIn PDF document text
  • https://cdn.sqhk.co/kakolutezegu/icTig59/4998313654.pdfIn PDF document text
  • https://cdn.sqhk.co/salijuvam/c6gd5hj/73511236733.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • http://latuwukatagowa.epizy.com/jefifosopikaziv.pdfIn PDF document text
  • http://delifas.epizy.com/maths_worksheets_year_2_tes.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8ae29e5d-5e83-4263-8f5a-ef743d6ec17b/intermatic_irrigation_timer_parts.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/383fc393-bb25-4135-b2d2-046c26d01eca/70885645238.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a1492aa8-6b78-488f-8ae3-55a2b2481f89/john_deere_lawn_mower_seat_springs.pdfIn PDF document text
  • http://rujipezoj.epizy.com/msc_botany_entrance_exam_books.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/43f23694-e842-48a2-85ad-f545a012fe0b/57295249467.pdfIn PDF document text
  • https://da54c32a-99c7-4590-8520-800dd2d1cae3.filesusr.com/ugd/7973d2_1f7bdb2268fa4d90a0f01026f8679e5a.pdf?index=trueIn PDF document text
  • https://b64dd490-e5b9-492f-89ff-e398ecee904c.filesusr.com/ugd/5926b4_9fd2e135c20748e186b03426a017acd4.pdf?index=trueIn PDF document text
  • https://b24036c1-08f6-4d5b-b8c9-f4c47f26e437.filesusr.com/ugd/ae9acc_e4a1fcae5816431393f32c1f3b3bde6d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/a5a1c23b-33bb-4c1d-a95b-514b954503eb/how_to_go_to_army_combatives_school.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ffa08d3c-a606-470c-92b4-5ee1902b02f7/matomewozomapizufusodib.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fc691612-980d-491c-ae4b-a21f8e115797/74097565332.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1e35288c-520b-4138-93bf-3b2ff3b16dc8/strength_training_and_cardio_weight_loss.pdfIn PDF document text
  • https://dc273c12-e125-4738-b2e6-b96bc4bd5eb7.filesusr.com/ugd/c8df25_89dc341d96844e6eb206960757d9b036.pdf?index=trueIn PDF document text
  • http://muxajetolalet.epizy.com/42422304610.pdfIn PDF document text
  • https://48936d5e-4b15-4059-a328-ddb12afcc15e.filesusr.com/ugd/173145_99f5d8311b41498db6ea07486556aa54.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/8c394d5b-70f7-4e18-94f5-1f55bad81641/1_what_is_the_most_important_line_of_latitude_called.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.