Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://lozipotod.ru/123?utm_term=teoria+de+la+accion+finalista+pdf PDF link annotation

  • https://jalewigevat.weebly.com/uploads/1/3/2/6/132681207/mopirisowowuli_kizor_nisetedem.pdfIn PDF document text
  • https://xorurilij.weebly.com/uploads/1/3/5/3/135325910/fanaxir_likurobi_sefiv.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://3176e400-c268-4dc0-8d69-08eae86937f8.filesusr.com/ugd/ea2f88_a566010793224501aa64352bf71ee31f.pdf?index=trueIn PDF document text
  • https://f3dcd8e3-6656-4b47-a81e-a993d3c4f2a1.filesusr.com/ugd/aa9ef2_c1bcc39eb1b34c128adbeb3d4bf40730.pdf?index=trueIn PDF document text
  • https://58552d80-c20c-4e4f-99b9-91bedbcc07a3.filesusr.com/ugd/c18496_c43bd9a984a64f999315ccb28fa52b27.pdf?index=trueIn PDF document text
  • https://d7b50aa0-fea3-4edc-ba9e-4ed0094b0c60.filesusr.com/ugd/7f614e_1c3fb68cc01a427c86a635286bbc0aef.pdf?index=trueIn PDF document text
  • https://5c54d0bb-9de8-469b-abb1-33232a952ba9.filesusr.com/ugd/370e3f_5448326fa55d4510b71802a46da7f3c1.pdf?index=trueIn PDF document text
  • https://b913155d-2712-4fd4-bcc6-651970a8c456.filesusr.com/ugd/e39924_ee76fe7fb8c540f28ccc0e6e240b1a5d.pdf?index=trueIn PDF document text
  • https://df4002df-ed14-466c-b758-10ced248c840.filesusr.com/ugd/3b03e6_da40a61431564ce592640cd7e1a38912.pdf?index=trueIn PDF document text
  • https://c31d65df-273c-4bcc-acfb-7b03b0724b99.filesusr.com/ugd/e7e4a0_3630033811a24c2aa0528b2c81192e48.pdf?index=trueIn PDF document text
  • https://57933e30-1e86-4cbe-ad2b-777cb72f9932.filesusr.com/ugd/235f1a_a57a31c981e146cea501a07e04dbfdd2.pdf?index=trueIn PDF document text
  • https://e9155d39-0f7d-4366-9ee8-34e17fe3d773.filesusr.com/ugd/9e05b8_95f012cc2d71407b86fc2dcd1ef6330c.pdf?index=trueIn PDF document text
  • https://21e323bd-7fdd-46e9-a6c7-4880e76d7610.filesusr.com/ugd/0a51c1_29f59f7e6b47471a8b2598d017703c43.pdf?index=trueIn PDF document text
  • https://acfc0e76-311d-46af-9c13-f46c112eb424.filesusr.com/ugd/f90bad_2a63cfd30e1140feaf561233f4873316.pdf?index=trueIn PDF document text
  • https://0503187d-52cd-4237-9521-a3cb9bf551ae.filesusr.com/ugd/5bb01c_7c5c1bd3793b43f69ae9560d18d64ecd.pdf?index=trueIn PDF document text
  • https://7f793f8f-877f-420e-851b-8bae9ea62a4d.filesusr.com/ugd/78c764_341fcfb4f4b44030ab8125a5aba3f54d.pdf?index=trueIn PDF document text
  • https://170d08c7-2527-4f8e-8bc4-cf7f6ffab704.filesusr.com/ugd/afe24e_146f6faf2ae4494f8a699fff13cd51fe.pdf?index=trueIn PDF document text
  • https://f84ffea9-2755-49c2-9cb5-47ca8b55fe65.filesusr.com/ugd/0adedf_66b068262b014456be3ec7fe2be85afd.pdf?index=trueIn PDF document text
  • https://329f26c8-0235-4118-8622-173d264d9cf1.filesusr.com/ugd/221f3a_47c5e557ccde469db9d1e95a6d185dd9.pdf?index=trueIn PDF document text
  • https://2a6c20f5-091f-48b5-a5be-bf749919b1f6.filesusr.com/ugd/3794ad_64f67dea24684b9e99a19cd2d1ad9575.pdf?index=trueIn PDF document text
  • https://feedbc21-cb93-402c-9ae2-3476589645d2.filesusr.com/ugd/f3ecbe_4d76c9ac78f448e19f30604ec969fde3.pdf?index=trueIn PDF document text
  • https://0d555108-1732-4721-8d72-76d747b2053a.filesusr.com/ugd/1b0481_b170809bad8c4ebda2f4d7b8e15ed17e.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.