Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://maypoin.ru/strik?utm_term=whirlpool+gold+conquest+refrigerator+not+working PDF link annotation

  • http://zutatowatipo.mywebcommunity.org/65884537083.pdfIn PDF document text
  • http://xoxuvajes.mywebcommunity.org/tahlilan_dan_yasinan.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://1864c106-1a4f-4194-99fb-dabd5a0af450.filesusr.com/ugd/17b194_d7c83138a5354342b2887cc34aa55970.pdf?index=trueIn PDF document text
  • https://f405dec1-7f90-4f4c-a861-5286f67d0127.filesusr.com/ugd/ab922d_f896141d51ba42f591fc1a827eb6dabc.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/7edc4db6-f928-4e08-8ba2-eebf635278a8/48172512412.pdfIn PDF document text
  • http://zijurape.atwebpages.com/sociolinguistics_and_sociology_of_language.pdfIn PDF document text
  • https://9c3086b9-336b-4a4d-b39c-975a2563a2e0.filesusr.com/ugd/f4f792_f1709cf59fba4fa3be1926d855dd61e0.pdf?index=trueIn PDF document text
  • https://cb6d8354-940b-4e05-9f1d-0150973ab277.filesusr.com/ugd/882da0_23033831d6a14e7eb41e8e5e42502328.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/b580f6b0-8ec2-424e-aafe-6cddaec1de6a/i_still_sleep_but_now_were_stressed_out.pdfIn PDF document text
  • http://nuluwajewugutik.onlinewebshop.net/nupepijumu.pdfIn PDF document text
  • https://cfc603e6-7cd4-4c42-812b-9722deb80ae4.filesusr.com/ugd/0e9fc2_c5ec91b2e9b941bfadf84195410c092e.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/a127f07f-c589-4b2a-95a6-1bfba22577ec/dagojasilot.pdfIn PDF document text
  • https://627ea4a7-3f28-4bf3-8c99-6a9da7dacf48.filesusr.com/ugd/1970e2_04e9f8e7e46a464baca0d061d72dcd16.pdf?index=trueIn PDF document text
  • https://3fb740b9-71d8-4183-8edb-de11b68c0a29.filesusr.com/ugd/1fbf8b_a93f7565d78d496ca014b9fe322967ca.pdf?index=trueIn PDF document text
  • https://3b87a2b8-2d13-4e6d-acc4-cbba57692a59.filesusr.com/ugd/50988c_39c7660c478e405c9985f71b9ce868d8.pdf?index=trueIn PDF document text
  • https://044ec7df-721b-4788-b209-87474a3fcb06.filesusr.com/ugd/60ffa2_1b42a838a67740e38112df15138581bd.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/a6d6bc68-605e-4ad2-aebe-cfd62d824548/modoba.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f2881ccd-8873-43ad-a011-b7847d45023a/cronica_de_una_muerte_anunciada_personajes_y_caracteristicas.pdfIn PDF document text
  • https://cf176ec6-4820-456b-adf9-61e5f06c968f.filesusr.com/ugd/43d598_5b08fbae6cea4730adbc77a109b20f73.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/68b8fd9d-f094-4944-aa04-02f84ef6d498/fastest_way_to_learn_mobile_app_development.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ec3e069f-5d18-4dab-84c3-9a8ad9e35e56/vugolosolaxamopa.pdfIn PDF document text
  • https://b3d988c2-7a7d-4c3c-9141-221b6550481e.filesusr.com/ugd/9dda13_87e9d0be515c4fd590814bf4055f0354.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.