Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://bologen.ru/strik?utm_term=yaesu+ft-450d+modifications PDF link annotation

  • http://wufamega.scienceontheweb.net/ajahn_brahm_books.pdfIn PDF document text
  • http://bagesopabiwub.scienceontheweb.net/facial_diagnosis_of_cell_salt_deficiencies_a_users_guide.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4489981/normal_6035d92050162.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4488566/normal_5fc736bdae8ca.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4456667/normal_5fdfccdcf2193.pdfIn PDF document text
  • http://wegaturagifo.getenjoyment.net/gexedufixop.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://be1b941d-c88c-475c-9260-a39c9d088d9d.filesusr.com/ugd/5c562d_a2989ecdf6404b73bbad29a804e4ee43.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/73dc9df0-aa35-4bc4-8960-c1dd219a8acc/zelekobumev.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2b5dd7fc-64f2-4409-b9fc-93fcb9afdb11/von_mises_failure_criterion_example.pdfIn PDF document text
  • https://0926596c-b1e6-4473-87d6-fed2e709bfeb.filesusr.com/ugd/e2a635_34b9e10e4a724c33b4d0da4f8ab956b1.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/d5929e1e-b424-4933-b532-2aedb8b13c68/47820263026.pdfIn PDF document text
  • https://1416a32c-f91c-4ec3-9c10-bfdf610c7df7.filesusr.com/ugd/76de1a_5043218b4ad74686a60f3ad37b13e3de.pdf?index=trueIn PDF document text
  • https://1527c8d3-3321-4e9f-872f-e2bebb57bac2.filesusr.com/ugd/bf2d42_a28c88da32ab4812b73ca07824243eb2.pdf?index=trueIn PDF document text
  • https://83d12552-0bc1-4415-b221-1da25caacb9b.filesusr.com/ugd/1e11d0_bced16f725d44c9baa24306d4b6c2b2a.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/026bd64d-ae42-44b1-8b0b-ecfc0c0b08f1/logeworozu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/06a86483-b913-46a4-882a-bb94061d97fe/rock_band_4_purchased_songs_not_downloading_xbox_one.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6d91a6ac-34b9-4bc9-a51f-e9c229b65e15/33022579749.pdfIn PDF document text
  • https://63995da9-74be-4895-8497-a4fa53c9845d.filesusr.com/ugd/788c84_51bb0b63ca8c4b0f9586f213e43181d6.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/8370142b-53dc-4f8c-82a9-4bc81339ebea/366975138.pdfIn PDF document text
  • https://1ec9b6e7-17eb-4e1e-a994-ba5ce4cbdb7c.filesusr.com/ugd/d4a9d6_0b5465dc188646e0b278c81b003daebd.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/f570a12f-6f63-461b-937d-a25ff6f4f4cf/coleman_lantern_lt_17b_weight.pdfIn PDF document text
  • https://a815f367-2516-4b88-9496-eed07d5c1eb7.filesusr.com/ugd/665c20_4a38b265192c4f9ca16e4dd693893299.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.