Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://leonvi.ru/strik?utm_term=dyson+dc59+battery+pack+6+cell+vtc4 PDF link annotation

  • https://kivuxobusev.weebly.com/uploads/1/3/1/8/131871605/9f181311beed.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4427085/normal_600969e8a3594.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4491934/normal_60680d9fa527d.pdfIn PDF document text
  • https://badosajag.weebly.com/uploads/1/3/1/4/131407507/sananupuwiluv-sapetepo.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4415526/normal_600e487534aaf.pdfIn PDF document text
  • https://wiguvufa.weebly.com/uploads/1/3/0/7/130775639/vawusarov.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4474218/normal_5ffe771685bd7.pdfIn PDF document text
  • https://biwamuneluzotip.weebly.com/uploads/1/3/2/6/132696598/eb3c7199e.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4371808/normal_5fce94848912f.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/8c1595c6-0305-4539-8c6c-ad398aa7a817/xoxasotek.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bff435a6-f53f-4ded-892e-216f86cebfe5/gukob.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/339b838c-fb66-4423-907c-9489a5648f3f/sundiata_epic_of_old_mali.pdfIn PDF document text
  • https://s3.amazonaws.com/jenisozazewubo/87517118012.pdfIn PDF document text
  • https://f187853a-68e6-4ed6-a420-9593b89d6738.filesusr.com/ugd/27c34a_a5183fed0e8b44a69d6ac7071c751100.pdf?index=trueIn PDF document text
  • https://18aefb47-0221-41c7-ace0-4f78eb33e730.filesusr.com/ugd/bca722_097829ba06b746ad8b9d171a3260ad06.pdf?index=trueIn PDF document text
  • https://9ebe8999-295a-4f11-87dc-c96f3e1b46ff.filesusr.com/ugd/8de238_ed6b06d59c38419790eaa9bca4b54ce1.pdf?index=trueIn PDF document text
  • https://40ba1f7a-6e91-49bb-bbb8-dfbb40a2bc60.filesusr.com/ugd/22bf55_ce4771c285d84364b3efa3291585ae8f.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/aabd4770-0a98-4b64-b47d-97929a62177e/vetoxefejuzowolaravepado.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7246e088-9df2-447b-9c3f-84a2114b0a65/toliduliwurita.pdfIn PDF document text
  • https://77483064-5892-4b52-b419-66e751946b77.filesusr.com/ugd/ef7b09_03dba69ea2c141aeb1ad5d587dec0a98.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/nisiwanolom/rababatofepilejememise.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/0664e5d6-8ee3-4ed0-9a60-0c48ebd88f11/69642496752.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2c155a9a-e0c0-4f9f-ab43-a419051b621b/shell_script_if_statement_multiple_conditions.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2b1101c3-0d11-4a34-9f43-b48cab4ef098/kekugejugulodez.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.