Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://seumenha.ru/123?utm_term=convert+bmp+to+jpg+format PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4459477/normal_603c888691900.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4469641/normal_603d31c0edc19.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4407781/normal_5ffb73150c79f.pdfIn PDF document text
  • http://lebojabufi.medianewsonline.com/kezogisug.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4376099/normal_5fdc7d3486d03.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4487187/normal_5fd9932f15484.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://87b84290-c0b3-4c73-97a1-3d59c64c3f69.filesusr.com/ugd/c638b7_0c96acfe63a24055be6b6285c8f5d1d0.pdf?index=trueIn PDF document text
  • https://2903667b-e544-4972-ac7f-e5855aaa9b37.filesusr.com/ugd/2cc660_17d002ee516a4321b77c572e51c8a2c3.pdf?index=trueIn PDF document text
  • https://27420876-d215-4860-9a72-f48db0d0c320.filesusr.com/ugd/4062c2_24af51ce711440be93d39ac8e3e5b19d.pdf?index=trueIn PDF document text
  • https://68a74d12-89ac-4a94-b826-09ad332a30bf.filesusr.com/ugd/1a0392_dc6810a07f05497fa4641863f941dfb1.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/89b2dc11-a4e0-4698-8387-024074bf1f67/what_does_schatzi_mean_in_german.pdfIn PDF document text
  • https://67acb2b6-3e42-4063-a073-371cb527a15d.filesusr.com/ugd/a81d48_6b36c15f7a804c9a85f95b454428df82.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/wowonesoribu/microsoft_project_2007_free_download_with_product_key.pdfIn PDF document text
  • https://081e7fb2-604d-424b-9b75-a58d54a71a44.filesusr.com/ugd/abd6ea_f3732496b2144daeaecd12a03d4be18f.pdf?index=trueIn PDF document text
  • https://e474413f-ff6d-4b46-a00c-d4c33541206b.filesusr.com/ugd/ddecc0_fff322644afd4f4e83f79fa583d1f5c9.pdf?index=trueIn PDF document text
  • https://87b84290-c0b3-4c73-97a1-3d59c64c3f69.filesusr.com/ugd/c638b7_ee0575bea7f640c3b86efc5630b48e3b.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/85c75e05-7860-48c3-b875-e5cc4ee4c7d2/are_death_records_public_information_in_ohio.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ddec4c07-54d2-4645-a7e0-49c8582745af/brother_mfc-j615w_printer_driver.pdfIn PDF document text
  • https://s3.amazonaws.com/kulinisokakewi/parts_of_speech_in_hindi_with_example_download.pdfIn PDF document text
  • http://molagegivijoxu.onlinewebshop.net/24409589319.pdfIn PDF document text
  • https://1ffb5d6c-d890-49e0-9b87-dc10fbfa49e2.filesusr.com/ugd/8bc2a6_c1924a18712d45c3944d8ed8bf8cd41e.pdf?index=trueIn PDF document text
  • https://070488ba-e3d9-4c74-834b-445551f5513c.filesusr.com/ugd/fb83f1_c1a8d5b8116649f486a7542f004659fe.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/mawesenasijoser/hungarian_rhapsody_no._2_orchestra_sheet_music.pdfIn PDF document text
  • https://s3.amazonaws.com/tesodagiwor/technology_of_the_gods.pdfIn PDF document text
  • https://s3.amazonaws.com/widofafane/wowurenunexusajanumus.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.