Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://baarspo.ru/123?utm_term=phonetic+alphabet+army+pdf PDF link annotation

  • https://cdn.sqhk.co/dejowipapoli/gUjjaia/zombieland_saga_lily_trap.pdfIn PDF document text
  • https://cdn.sqhk.co/nezuxada/ieOjdhg/5x8_index_card_template_microsoft_word.pdfIn PDF document text
  • https://cdn.sqhk.co/minamojazi/gchc7hi/hungry_birds_eat_it_or_wear_it_challenge.pdfIn PDF document text
  • https://cdn.sqhk.co/bukevexej/ifBujam/94356788819.pdfIn PDF document text
  • https://cdn.sqhk.co/nisuxibuzoru/jh0ierO/carte_du_ciel_android.pdfIn PDF document text
  • https://cdn.sqhk.co/lopijikuvi/hjtBjet/notre_dame_2020_football_schedule_ireland.pdfIn PDF document text
  • https://cdn.sqhk.co/jigavozef/slxgegc/turbo_drag_race_scene.pdfIn PDF document text
  • https://cdn.sqhk.co/rorijujulo/cIo0vgi/carx_highway_racing_hack_online_marugames.pdfIn PDF document text
  • https://cdn.sqhk.co/raserijene/Sfhfjjj/fudukenawofunadoka.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/7c3a70ca-5211-4b8a-a01d-033b3bc41978/wejovugonepurini.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/51a807a5-7715-4bfa-a50a-c04ac1ea0754/95467316651.pdfIn PDF document text
  • https://5c09c65f-4728-49e3-9562-8692e696fc4f.filesusr.com/ugd/32acb1_4381cbb692214999b1ecdabd98e16dfc.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/4215575b-5b0a-4eff-b072-b9daaee8ddfe/dofasagifux.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/71f7e206-e980-4336-86a6-40b93da293d8/46798109582.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/be2fd7f5-18ef-4d1d-8255-d591b16de3fa/12786471240.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bee5e746-e3e4-4ada-b864-9e512e466085/49928663862.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4f74e2db-e547-44cf-a096-85f273ee8088/centerpoint_crossbow_scope_4x32.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ed42185c-2883-47b0-8b3c-539e59bebc97/karr_alarm_honda.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d7f1b697-9e92-4c7b-9cf4-56d3bcf2b2d9/vocabulary_builder_app_ios.pdfIn PDF document text
  • https://7f2467c6-0d80-4e38-8df7-27624e0b9669.filesusr.com/ugd/e19533_f5fd519228ce4cf6a32cb9f31e548c21.pdf?index=trueIn PDF document text
  • https://e5eb5b25-b33c-43e3-82d5-57ab1bf863d8.filesusr.com/ugd/b0c717_f62a4e4025b948cab106ddbdfd0e1ce6.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/7597749a-8bd0-4fc0-bc31-7185125a6c68/fit_for_life_24_10th_street.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bab0204e-5df2-418d-9cbb-804f9b284be7/mojubodev.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/23deb608-afc2-455f-9d09-9eac5ea967ed/monster_synonym_word_hippo.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.