Malicious PDF — malware analysis report

Heuristics 8

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• ClickFix social engineering attack high SE_CLICKFIX
  Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
• Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
  Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://resalured.ru/square?utm_term=logitech+k800+keyboard+settings PDF link annotation

  • https://cdn.sqhk.co/fekolisuzub/fm7jhgh/tonuvanepulupejotul.pdfIn PDF document text
  • https://cdn.sqhk.co/widafopaj/4yMhcc1/switch_pro_console_2019.pdfIn PDF document text
  • https://cdn.sqhk.co/jabakujivim/Eji2tmT/subscriber_count_james_charles_and_tati_westbrook.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/mafavuzenoliki/winipew.pdfIn PDF document text
  • https://s3.amazonaws.com/pegozegi/messenger_facebook_windows.pdfIn PDF document text
  • https://c245485c-e1a4-4c5a-9a2a-c465a95e53c8.filesusr.com/ugd/25f824_5c9a7de624a347809ab3fa9ba7d94582.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/tobaziw/e._tv_guide_list.pdfIn PDF document text
  • https://s3.amazonaws.com/donake/bostitch_framing_nailer_n80sb_manual.pdfIn PDF document text
  • https://s3.amazonaws.com/regufojalojaza/uc_browser_free_for_windows_7.pdfIn PDF document text
  • https://s3.amazonaws.com/pasawe/tadapefalisudov.pdfIn PDF document text
  • https://s3.amazonaws.com/kudowo/dunkin_doughnuts_wake_up_wrap_nutrition.pdfIn PDF document text
  • https://7e073981-ad1c-4081-8dc0-76946ba36063.filesusr.com/ugd/c4f63d_5e15dd3e27564330941129717e24d82b.pdf?index=trueIn PDF document text
  • https://bcd7deca-fd5d-492b-a220-d373ca515bc9.filesusr.com/ugd/12f4eb_521e0ce6966c4ac6b6ab04cc7190d598.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/343559ff-25b7-436c-8a1f-6e80ad882ab0/97728172421.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1ece5f6e-c484-4df9-aa23-426611c22f79/robufolesamiwudune.pdfIn PDF document text
  • https://s3.amazonaws.com/jevedijadiki/tv_guide_nz_one.pdfIn PDF document text
  • https://s3.amazonaws.com/wetowuzuxit/tunajesuwopupakeferoxadi.pdfIn PDF document text
  • https://123949be-7110-4ba3-a240-a7df06fb38ce.filesusr.com/ugd/80fd5d_c6ed6c0b89cd4961a9ad6ecc4f61eeff.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/veraxawewib/76511210194.pdfIn PDF document text
  • https://d23eb412-52e1-45ef-a32a-0c032022daee.filesusr.com/ugd/03485a_c98e884c332443ff87edd08b497d83d5.pdf?index=trueIn PDF document text
  • https://43081b45-6e48-4b43-b724-9328fda377ae.filesusr.com/ugd/26481d_0b8f800bba0445249402b472225a5078.pdf?index=trueIn PDF document text
  • https://0ef2f354-78a3-4528-990c-72f69c86fc6a.filesusr.com/ugd/6a0da6_018a8c48dcba45e0a9e8bf258555e13c.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/b891c5c4-0028-4b14-83a8-072d811eb979/ritoxezifutulojubifejowab.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d0d0eb0d-3f63-4bbc-b771-6da7d861d3ff/davinci_kalani_4-in-1_convertible_crib_assembly.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.