Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://dafemum.ru/strik?utm_term=how+to+connect+samsung+tv+remote In PDF document text

  • https://cdn-cms.f-static.net/uploads/4377697/normal_60172ab251d27.pdfIn PDF document text
  • https://cdn.sqhk.co/nudabesawi/gh2ifgU/block_hexa_puzzle_high_score.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4464065/normal_602ebdb122fa0.pdfIn PDF document text
  • https://cdn.sqhk.co/xurinuwame/cNICEhi/automotive_nuts_and_bolts_melbourne.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4367000/normal_60138d3c3fc5c.pdfIn PDF document text
  • https://cdn.sqhk.co/nimuxugemu/ciaFie5/mega_jump_party_prices.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4473388/normal_5ff973ba07eb1.pdfIn PDF document text
  • https://cdn.sqhk.co/ripigopes/ggjhXjj/50726891391.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://f1fb087f-5d49-4061-aa02-230b108315d3.filesusr.com/ugd/645068_2827fb7cf9d24e1cb1b56d727e32af99.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/6c4fd840-e4fa-435f-98e6-bbf1cf21200c/star_wars_rpg_book_list.pdfIn PDF document text
  • https://b9264059-5ce6-458a-812b-58b21e0c51d1.filesusr.com/ugd/9a3dc1_34bee691727241eba26694ee49d1e62d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/3470c4f1-1944-48fd-bac4-100bcb36a9c3/theory_of_relativity_meaning_in_bengali.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/18f58fbc-99ec-41d1-83e0-b00c0e78f792/tokyo_ghoul_touka_and_kaneki_wallpaper.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/29f8faf1-1f3d-4d70-bb38-6d8297613c16/can_you_share_a_private_group_on_facebook.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/00cc4064-bca3-466a-8b7e-a63a7722e858/zajujopuponukidebulameze.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d84482a5-8397-4f7e-93d2-d16a87356bb5/will_a_kerosene_heater_heat_my_garage.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/196bce09-df98-4985-9e65-9ecb220c513b/que_es_un_bosquejo_biblico_y_como_se_hace.pdfIn PDF document text
  • https://2080fafa-2491-4ac3-8118-a138f33bff34.filesusr.com/ugd/822ecd_217a2398f3e04ecebcb2ac384ef004b9.pdf?index=trueIn PDF document text
  • https://5a8aee2d-3d68-4c09-98ed-743c9c56d6fd.filesusr.com/ugd/460efe_afeca6b729fe4612b1bc2775df5e0a96.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/a1a96c13-b9a3-4707-b82b-833bddde59e3/13783002958.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.