Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://botokaw.ru/strik?utm_term=chicco+keyfit+30+manual+newborn+insert PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4479213/normal_604db6f69777d.pdfIn PDF document text
  • http://familyit.pro/skyrim_xbox_one_divine_mods_load_orderau662.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4464873/normal_5fff23be5e476.pdfIn PDF document text
  • http://ital-girl.space/modern_warfare_remastered_trophy_guide_roadmap6hs6x.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4454054/normal_5fcf07643d3e5.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4368950/normal_604affe6a3f91.pdfIn PDF document text
  • http://stroiline74.ru/821559951949j39j.pdfIn PDF document text
  • http://libralab.digital/how_many_episode_will_that_time_i_got_reincarnated_as_a_slime_haveoduk0.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4468814/normal_6007edcd367de.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/be4ce36b-a801-4a65-9f24-b6ff1f59c05d/83688802348.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6e632a01-9b59-4ac4-b57b-531653c6a768/how_to_use_farberware_immersion_hand_blender.pdfIn PDF document text
  • https://edb7bb8d-792a-4213-93ec-7f573d37cc74.filesusr.com/ugd/bfd504_477b003b4ac64cf8a3c717a2d333fa20.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/c26b6636-1765-4134-bb12-e42b8c7b2ba7/weber_7661_handle_grill_n_go_light.pdfIn PDF document text
  • https://2d2b1dae-c014-4902-97e6-c3f1d56915cd.filesusr.com/ugd/70e5f7_35ac144d4540402898dbd3e7fa4e8808.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/0842d9e0-c04c-4bd5-a3dc-a629dc12b64d/64719241413.pdfIn PDF document text
  • https://aefbb2f1-1cfc-4a48-aab2-d72547d84173.filesusr.com/ugd/2f3ac6_86e4fd386b8e4c9fa510f65e982b1f25.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/36e86d21-b11a-4c75-a4d3-d1a86ec54b6f/how_to_fix_garage_door_opener_craftsman.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/57b29b70-56aa-4dbf-8e03-e9618fbf915f/xenupijoxuvu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2eb46ffc-c480-4779-beda-e68335aa3c09/batch_file_hide_command_prompt_window.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/87cd5739-2228-4566-a45a-a73a90493af5/when_did_christianity_decline_in_europe.pdfIn PDF document text
  • https://5c3e38fa-bf2d-4cda-bfdc-19e9a39f2227.filesusr.com/ugd/b3ada4_95898104e6e04797b48a29f13d59cd9f.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/0469040b-4e8b-4ecf-a89b-ea49a7501c50/behringer_q802usb_xenyx_premium.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/70bd92a2-3fd5-404d-ac8a-5a507e1f83a0/josamitilotunawatumawuxut.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8301193d-a0f2-43b5-9c97-d35e432a0bd5/finavexof.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c50ea2a8-4d02-4c12-9deb-4433bf11a43b/java_8_tutorial_oracle.pdfIn PDF document text
  • https://ed7c5604-ec0f-4ae6-9d22-6d534b57d154.filesusr.com/ugd/1d5a3f_7c3a6d57bb0547a9bae45301652c0fea.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.