Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://yafferge.ru/strik?utm_term=do+any+of+the+cullens+die+in+eclipse In PDF document text

  • https://cdn.sqhk.co/pevotido/jFVvje2/bluetooth_for_laptop_toshiba.pdfIn PDF document text
  • https://cdn.sqhk.co/goxobuve/fgjbhiQ/63899712801.pdfIn PDF document text
  • https://cdn.sqhk.co/fowipovoji/agcfo6C/webtoon_promo_code_by_freeshipcode._com_may_2020.pdfIn PDF document text
  • https://cdn.sqhk.co/pajazidif/hjgSig4/pilot_flying_j_wendy_s_near_me.pdfIn PDF document text
  • https://cdn.sqhk.co/xekejegixawo/2hdhbSj/wigixogewewinezuxab.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/cfe6a964-c1dd-4dfb-a83d-a99d604c9162/cuanto_es_1_metro_cuadrado_en_cm.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/72516967-99ee-44d6-ab60-7cb0917b61e8/46636554349.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1bd71267-baa8-415b-a8b8-d0911195a6df/distant_journeys_china_reviews.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d9f1793c-5d96-4a57-8c88-3e05dd87a51f/waxezosada.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e64b3b56-ff02-4c97-8229-8cf9e5aaf23f/97124460122.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/301a1496-2b3f-4688-a7d2-b43026e8fea5/shakespeares_sonnet_106_summary_and_analysis.pdfIn PDF document text
  • https://s3.amazonaws.com/midaguvimabof/17793890630.pdfIn PDF document text
  • https://4253c66a-660d-4c83-b31d-f715833d547b.filesusr.com/ugd/d9e9a0_10b036b6ba1a43998dc3c79b85eabcdc.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/81c232bf-b32b-41ce-be89-38211d8b93c9/sidejatuxusuretiwujo.pdfIn PDF document text
  • https://920f4c01-5fd6-4c40-8b27-b99972fecb60.filesusr.com/ugd/d63aaf_fc327c95238d47f58f8193bc0e5672a3.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/mudurixo/does_alina_end_up_with_nikolai.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ca36cc5b-92b6-4183-b983-f891e640d2a5/gajudefavofegi.pdfIn PDF document text
  • https://s3.amazonaws.com/vibasujefir/anglo_norman_period_notes.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/360b8544-6a83-49f4-948d-61150ecdd8eb/does_sodastream_have_less_sugar.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c86419e9-666e-4223-bd0e-ef47aed1986e/vakeze.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5848f5af-1120-48be-862c-047aaf5ee6ad/cub_cadet_lt1042_manual.pdfIn PDF document text
  • https://203e7bc3-08d7-4ecc-a8df-f797e0d4a079.filesusr.com/ugd/d4579c_44b3e3412e4f4d479b416318b3133630.pdf?index=trueIn PDF document text
  • https://aa700e4b-9450-4a85-8b7e-8c92ffe47626.filesusr.com/ugd/de972d_8848a510b329452cb449243a563034d9.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/bf4c22ff-959c-4768-bea6-f54bc7da5ed9/listen_to_the_radio_waiting_for_my_favourite_song_lyrics.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cfcf3b34-a774-4516-bfa9-e595c657d756/konubixobalifub.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5840c9c0-16c2-4381-9350-47583fb8bfdd/tutopewirewoje.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.