Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://soxebez.ru/wix?keyword=demonology+warlock+pve+guide+4.3.4 PDF link annotation

  • https://viwezoluzuwa.weebly.com/uploads/1/3/4/4/134401695/7067783.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4485016/normal_603d51538e485.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4417040/normal_5fe1a4549f654.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4480905/normal_60166fcf9e240.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4408865/normal_605271133dd5f.pdfIn PDF document text
  • https://sawefewukiwow.weebly.com/uploads/1/3/1/4/131406412/64c44279971d.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://0ed7c29b-d5f2-4290-8b47-add6aa38300d.filesusr.com/ugd/32a223_6bd1adab9351467dbe4e23b14a630d56.pdf?index=trueIn PDF document text
  • https://71e5fc8e-cc9a-4633-96c3-2c70acd464d0.filesusr.com/ugd/f08e01_3d3dc30ba2514a9eaaf1e3c523919424.pdf?index=trueIn PDF document text
  • https://b73b9701-b1df-43be-b031-73419f87697c.filesusr.com/ugd/bfbd96_c9b3593bf1ea4eedafb4af273c8feb5f.pdf?index=trueIn PDF document text
  • https://f8e303d0-f350-43d2-b7c3-f886ef13ec25.filesusr.com/ugd/1bb397_29f2165e9ec34d8d830773316e412f79.pdf?index=trueIn PDF document text
  • https://748e6e98-33e2-4bd1-95aa-01ea3505a154.filesusr.com/ugd/704f6c_2977e84bc55c41b6874caa4595567ff2.pdf?index=trueIn PDF document text
  • https://90b6428a-f85d-4fb4-90f7-6cca40d0dc23.filesusr.com/ugd/55544c_d6271ba20b5748f9859e905b67cf4721.pdf?index=trueIn PDF document text
  • https://44eeb0f0-4dc9-4d8b-b3fd-cc7ace98e90e.filesusr.com/ugd/a083a1_ba1bb9042a3848ba8c9e7de922b4ffa2.pdf?index=trueIn PDF document text
  • https://601bead5-a720-4f65-98db-62fe2a42cb91.filesusr.com/ugd/0e52b4_d911e738bae2408ebffe3088dfbdfb06.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/25b750b4-c609-4157-8f84-42298c01f9c4/5928139906.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c612d23e-c460-461f-81f6-017250efb5e6/faremulador.pdfIn PDF document text
  • https://add83a7c-0e31-48b3-928b-061d82ba9144.filesusr.com/ugd/205ae4_ed12a26970b74566b6074c64eaf2b34e.pdf?index=trueIn PDF document text
  • https://7a579b3f-ce96-4c66-abdc-991530493d29.filesusr.com/ugd/010c6b_530d348322114259bd044eb3dd0c519f.pdf?index=trueIn PDF document text
  • https://d5bea983-5bca-41ba-aae6-6b688785cc77.filesusr.com/ugd/9ec29b_60846b23bdcf4e379235906616ec38ba.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/c65d83c8-099c-40cd-9328-96a483302c7c/minecraft_how_to_render_faster.pdfIn PDF document text
  • https://27f1a270-5048-4778-87f0-574dfe85248a.filesusr.com/ugd/b7306e_03fc7d1dd41f4473a8ab9a8f44c45b94.pdf?index=trueIn PDF document text
  • https://d6236f05-450e-4b96-9875-1783d83c708b.filesusr.com/ugd/912de2_a9bd4d6fc24a4cd9a1da456c78f3b249.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.