Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://seumenha.ru/wix?keyword=arras.io+private+server+betta+tanks PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4448536/normal_6031683648278.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4448750/normal_600bc9d9972ca.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4372985/normal_60296fbb6113d.pdfIn PDF document text
  • https://cdn.sqhk.co/gufezitaxato/jPjcsQB/play_pac-_man_vizzed_midway_arcade_game_online.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4501998/normal_601de44bed2dd.pdfIn PDF document text
  • https://cdn.sqhk.co/fovipobex/dgijdGw/rufulikuvojelegas.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4456393/normal_5ff9eead24d30.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://4eff3ec4-d147-45d1-be73-876d9e1d0019.filesusr.com/ugd/efb3f0_06ba0c51330d44eca51852738552cade.pdf?index=trueIn PDF document text
  • https://6f4861c6-cdf0-4a5f-ba2d-f9c5e5bfbee6.filesusr.com/ugd/77941b_c2cb34cb5088406f99a3ffb29d03d718.pdf?index=trueIn PDF document text
  • https://bcd7deca-fd5d-492b-a220-d373ca515bc9.filesusr.com/ugd/12f4eb_d58ca0be64f94e66bec47b63b6ab3c7d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/b9a71501-7463-411e-afeb-94b0927ffe3d/are_mineral_spas_good_for_you.pdfIn PDF document text
  • https://6e229dea-1f83-4be8-8cd3-388eabd4f5e3.filesusr.com/ugd/1cfe37_37c5a27c44e949f288dbd48dcdf03b9c.pdf?index=trueIn PDF document text
  • https://1e16da7b-5b4f-4122-a3c4-5c88c9d97cf7.filesusr.com/ugd/83f04e_e240d49a927e42c1bd5f2a64c312ad0a.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/97e71ed6-273a-4f50-aa93-e93aac94923d/atpial_an_peq-15_price.pdfIn PDF document text
  • https://16dc6c2a-32e3-4a69-9eea-5b59d93654f8.filesusr.com/ugd/176c29_13dd7ec3fd2f46d48fa140a7a1703c42.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/4b4f14a5-3a87-4912-a93c-31c6c725c87a/chicco_keyfit_30_assembly_instructions.pdfIn PDF document text
  • https://5e54824a-8208-41b0-8aeb-7c017e8cfb46.filesusr.com/ugd/f64db8_a018d72a3cc4410889af5c798084ae26.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/e991c55b-f144-451a-9216-a9868a3922f5/bikelewemobupiji.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c3051654-3b70-4477-91de-50c4255c6865/75027939177.pdfIn PDF document text
  • https://e0ff2378-281a-4ea3-95ae-419c526fdc99.filesusr.com/ugd/0baf77_cd04a759f9ac47bab1b69fa5d0dd73a3.pdf?index=trueIn PDF document text
  • https://b27aca93-056c-4dd2-83a6-fd909c9f709d.filesusr.com/ugd/2ba3ac_d0ec4f8a961d432f84589f49af0298ec.pdf?index=trueIn PDF document text
  • https://de315c38-daa2-4293-b666-e554ba9b7d65.filesusr.com/ugd/564d2e_1ad55e1c7f21436e81ee0a2eef5e58e3.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/6927f796-784e-425e-84b9-cd8429a6ca32/what_is_the_scientific_method_kid_version.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/017a56a4-ee03-48ab-8382-36f22abbc577/reniwebosowuguwadifosamo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ba10bbf5-f6d1-455f-bf3c-f19468a6b688/what_is_critical_appraisal_in_qualitative_research.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.