Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://botokaw.ru/wix?keyword=paradise+of+the+blind+full+text+pdf PDF link annotation

  • https://xulakuvoloja.weebly.com/uploads/1/3/0/8/130813987/409549.pdfIn PDF document text
  • https://cdn.sqhk.co/delopomixaba/JJ6ohfR/vavugoxera.pdfIn PDF document text
  • https://cdn.sqhk.co/sadebupunen/XgdiaW3/caption_for_photoshoot.pdfIn PDF document text
  • https://cdn.sqhk.co/pujixefan/ijhjjcF/megacraft_pocket_edition_apk_download.pdfIn PDF document text
  • https://cdn.sqhk.co/zukasedu/hqjbiew/xakukilojiwigadizafedak.pdfIn PDF document text
  • https://vinixojaz.weebly.com/uploads/1/3/5/3/135312356/ab3909d43c.pdfIn PDF document text
  • https://cdn.sqhk.co/roratumopiv/xkMUmhg/lego_blacksmith_6918_instructions.pdfIn PDF document text
  • https://binenivav.weebly.com/uploads/1/3/4/5/134516867/92e809.pdfIn PDF document text
  • https://cdn.sqhk.co/wajuletixex/0EoNhc0/kusodixogeworifabulo.pdfIn PDF document text
  • https://cdn.sqhk.co/saboxiwago/eJia6id/46883886804.pdfIn PDF document text
  • https://cdn.sqhk.co/kitujesijak/HgiHLlE/amazing_wallpapers_for_ipad.pdfIn PDF document text
  • https://cdn.sqhk.co/gegojagakexu/ighf260/spacex_mars_colonization_video.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://aabf49e0-5477-4fd2-8456-a986ef8f2a87.filesusr.com/ugd/9e14ca_6df0aaa66f6d4a49bfbe3fb811d5dd36.pdf?index=trueIn PDF document text
  • https://165b0ab0-89c3-4517-b88f-e2bd0c55d975.filesusr.com/ugd/97b555_15d528fe91b1464195f682251fed3840.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/0530ee33-4daa-4660-a290-1d222d6bcf89/acer_aspire_v5-571g_i3_specs.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cb45bcaf-593d-4bac-842d-769298650915/88358797656.pdfIn PDF document text
  • https://054d5c26-596f-48a3-87a7-0fc79031e5db.filesusr.com/ugd/599026_060075f61eb6421a867c656d8759c201.pdf?index=trueIn PDF document text
  • https://c5e26362-acc3-4c40-9db4-ce0cbd355080.filesusr.com/ugd/681527_db3c316ed1454bde8ad0e0abcf26f174.pdf?index=trueIn PDF document text
  • https://60f6da8c-824c-4163-aae9-6195f2ac7ed4.filesusr.com/ugd/7f16bd_7c74eb767c0b4fbdb870538b6e78802e.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/04d0275f-d0b1-4aa1-acec-0842fb105ed9/tumod.pdfIn PDF document text
  • https://d451e762-8e00-4155-9971-9512d28d2528.filesusr.com/ugd/b52961_182d6bc0ae454c168a94b16098d7b7c5.pdf?index=trueIn PDF document text
  • https://891dfe3a-8969-4df2-b253-5ccc4ebbb7a0.filesusr.com/ugd/e66789_11e0f1cafd5844e8bb851f1f687b8b95.pdf?index=trueIn PDF document text
  • https://f7e05ffc-afae-4d19-be15-7e9c659e5e5f.filesusr.com/ugd/72f62b_ee759229b1834d1ab8e906dcff3f7afd.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/3d8ca256-6c61-4aa8-bfe2-09c99e03e095/camera_shots_and_angles_in_hindi.pdfIn PDF document text
  • https://ca483b97-61ac-4196-bca0-6b249c18eca9.filesusr.com/ugd/b27199_3228f819e4754f46b7f894d62909bde1.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.