Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://resalured.ru/strik?utm_term=what+percent+cocoa+is+hershey%2527s PDF link annotation

  • https://cdn.sqhk.co/vefuwatak/ejgjjsy/45716315854.pdfIn PDF document text
  • https://cdn.sqhk.co/mevazasid/gLjdTgi/pipijorin.pdfIn PDF document text
  • https://cdn.sqhk.co/gasubapo/jefzhcJ/linkedin_learning_certificates.pdfIn PDF document text
  • https://cdn.sqhk.co/vakenuda/eaCHBia/fall_race_3d_online.pdfIn PDF document text
  • https://cdn.sqhk.co/wobuwozavenu/gc1uajg/free_wifi_calling_ios_6.pdfIn PDF document text
  • https://cdn.sqhk.co/gudijupimeb/ktge0jK/motorcycle_racing_3d_game_free_download.pdfIn PDF document text
  • https://cdn.sqhk.co/lilomovetum/gg9IgUC/4343025924.pdfIn PDF document text
  • https://cdn.sqhk.co/metexemoraga/aJhhCNJ/hay_day_wiki_level_66.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/408173dd-aefd-4942-a5e8-67f8f4dc236a/bomabawi.pdfIn PDF document text
  • https://e905e09d-7ddd-4aab-833c-73500e817873.filesusr.com/ugd/f4c08b_2c88829bd9164ff28063c1281152efba.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/patotale/mumudinazifigizopu.pdfIn PDF document text
  • https://43e3b293-20b6-4b74-9f7d-0eefffb4d2df.filesusr.com/ugd/11595e_2d2cd257da8f4211bdf5a5a14b4ed6a7.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/0f915947-b68a-457b-9775-edcd0b841a66/metal_gear_solid_5_ground_zeroes_achievement_guide_and_roadmap.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a01cdce7-7fe4-4e53-8e24-9ebc52491e58/zapejom.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dfa9f416-475b-4a5c-ac23-c041292317f9/little_house_on_the_prairie_season_9_episode_18.pdfIn PDF document text
  • https://s3.amazonaws.com/sogovekevi/asian_games_2018_logo.pdfIn PDF document text
  • https://6478d21b-237c-41b5-add8-96d7b9819624.filesusr.com/ugd/c7ef1a_f7ffaf923f294b23b8fc2bbba90c0edc.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/4858ef59-d0f6-477a-babf-7787435e4c45/feliz_navidad_meme_gif.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6f995fb7-63de-4d74-b9fb-fcbd3266cebb/lezabefazakawij.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3f8ae4f9-2110-4e7d-a2b7-5a8559252666/starburst_rock_cycle_lab_answer_key.pdfIn PDF document text
  • https://af1bea64-f5cd-41c2-a7c1-97f21c1aa057.filesusr.com/ugd/592671_a7e84355486e406592cdac21b2f11175.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/0de8bbe1-0a9c-4b72-b13b-a2b503c6f30b/the_upside_of_stress.pdfIn PDF document text
  • https://d8acad56-eb9a-42d1-a06c-a695c5b02328.filesusr.com/ugd/0ad6c7_0c0cf3f671c04581b291b84fc47bf10c.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/1503d6dc-c050-41ef-9c3c-e2f6ded32aac/94209254693.pdfIn PDF document text
  • https://s3.amazonaws.com/wiremeresegikon/65078995875.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.