Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://botokaw.ru/strik?utm_term=how+to+train+your+dragon+characters+black+dragon PDF link annotation

  • http://wimebenese.getenjoyment.net/9095192953.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4500417/normal_60342c31d0392.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4462341/normal_6036744285418.pdfIn PDF document text
  • http://setokanekema.mygamesonline.org/calculus_on_manifolds.pdfIn PDF document text
  • http://butalinonoruma.scienceontheweb.net/acrobat_software_download.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4382976/normal_60520066e28fe.pdfIn PDF document text
  • http://pokezokebawi.mygamesonline.org/portland_trail_blazers_schedule_2020_18.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/114b7869-04a0-4d24-9417-f4fef71522ae/58013142952.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/00ac7c5f-61f5-4113-84c6-d6d0ddfda97b/husqvarna_455_rancher_bar_and_chain_specs.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dd0bfad8-6c94-47b2-a02d-8064d7d40e44/cdma_workshop_tool_2.7_0_download.pdfIn PDF document text
  • https://4abf464d-34d5-4c80-8de5-e64f30e04530.filesusr.com/ugd/8b3eb5_cd5f4b70a53a42efb04d10ea9501093e.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/3cd820f3-9ffc-4dd4-9f82-4d684603cb05/vigiturekupopumaxez.pdfIn PDF document text
  • https://b5d51143-f34a-4a4f-9265-6917490cb775.filesusr.com/ugd/9f69bd_3bac93fbc7e04113b26490e48ef9d042.pdf?index=trueIn PDF document text
  • https://591e60e9-54e8-4b06-a9a7-f2e0522969d0.filesusr.com/ugd/1fd4b7_8f04e89881654260be5659b3ef417d2b.pdf?index=trueIn PDF document text
  • https://5405d108-7f1e-482b-a10c-e06f62b7505d.filesusr.com/ugd/d941b1_f6474ccb60674448b84f23fa5e4620a3.pdf?index=trueIn PDF document text
  • https://d6d3a1c5-32ce-46e9-ae92-c5b8d84d65d9.filesusr.com/ugd/a3b54b_35607dd08dde47458f4c23c13e379acf.pdf?index=trueIn PDF document text
  • https://a5fc3680-5c08-4cda-bd6c-abaa3bdf25bc.filesusr.com/ugd/ea5d7b_28b102eba5854c4cb5b79b0e0a9808ee.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/eceae4a5-d0e1-4200-a75d-9b62be2775cb/41655530302.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2f05c1d4-c50d-4a1e-a024-43d7d2a64075/pic_print_app_walmart_photo_prints.pdfIn PDF document text
  • https://8137cd1e-393d-4948-8193-eca935452849.filesusr.com/ugd/756799_2fa504c943114006aa09ca4a78109b10.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/0e7b9ec2-a9ef-4f98-b86e-5d3338aeafa3/gadapoxu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/45751f9f-a973-43f8-b772-66fdef320611/bugarab.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a132b3ec-4d4b-4f2c-b5db-d0affade6143/bijesi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dd733508-b3d9-46f1-bdb5-7a8ae4ba1e11/black_and_decker_36_volt_string_trimmer_manual.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.