Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://fokemale.ru/strik?utm_term=famous+quotes+about+diary+writing PDF link annotation

  • http://4bochki.ru/2006_chevy_malibu_ltz_specsj4x0l.pdfIn PDF document text
  • http://mp4.design/place_value_worksheets_grade_5_freemfvfd.pdfIn PDF document text
  • http://kigurumi.org/21761632605dautj.pdfIn PDF document text
  • http://ru-en.xyz/krups_xp1500_how_to_make_espressojxylp.pdfIn PDF document text
  • http://artyom.guru/273508926481w1cw.pdfIn PDF document text
  • http://virnet77.ru/red_ball_hero_adventure_pokia1v6u.pdfIn PDF document text
  • http://flowerport.store/gateway_dx4860-ub32p_upgradesq4fu3.pdfIn PDF document text
  • http://alexandreablog.com/lanoforuvurop3lbq6.pdfIn PDF document text
  • http://jadebey-x.com/garmin_vivofit_4_review_indonesiaw3pz5.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/db899dc6-bb57-4239-8012-91272a61e786/what_are_text_structures_in_reading.pdfIn PDF document text
  • https://27dd58ca-3bab-4825-b0a2-cb75a9f796de.filesusr.com/ugd/aba4c5_89b0dcec30fe4b65a05ac3196264594b.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/0bb59b1d-8944-4400-866c-8027d28a3597/zudiros.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/687d5161-d316-44c4-bfb1-36dadb5847ff/how_often_should_you_replace_your_shark_vacuum_filters.pdfIn PDF document text
  • https://17851959-1482-4b49-8222-7b7b0c628459.filesusr.com/ugd/3cb679_96b0dfc807b64c6f8f18916505bd5dff.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/e948833b-ad4d-48b6-9d73-61e546855c7c/89898864317.pdfIn PDF document text
  • https://18cb0a1d-3822-48a5-9ca0-56465202bc9b.filesusr.com/ugd/96564c_9aaacc255c124304b2e448535184e750.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/f85234c3-9f33-4332-b484-e6d8d4809bd1/pentair_superflo_variable_speed_pump_manual.pdfIn PDF document text
  • https://4ec63ec4-77bf-4499-900e-7c522af20654.filesusr.com/ugd/35bdb9_69d85644dd1841d0ba60e5974e8b963c.pdf?index=trueIn PDF document text
  • https://ca39a19f-16f9-469f-ab0b-65ec0463b8d0.filesusr.com/ugd/cc9b97_902eeebc9d6b4cfea843c1805a80dece.pdf?index=trueIn PDF document text
  • https://6376acfe-5884-4251-b3d5-19a03c044549.filesusr.com/ugd/de3d83_5705a4e692384bda88c17599268113bc.pdf?index=trueIn PDF document text
  • https://e2604e0b-f95a-4acb-b53f-a7db3827b2a1.filesusr.com/ugd/225520_e904faed97444762a30a6051c74295f0.pdf?index=trueIn PDF document text
  • https://e26dc784-fa46-4601-9f6d-57686faaf216.filesusr.com/ugd/c66525_83dd7646f783406b99cb3348940930dc.pdf?index=trueIn PDF document text
  • https://18e99e0c-7034-4a8c-9069-267580a295b8.filesusr.com/ugd/b337f5_2be83148ffb64919833fefe1180bf5c7.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/9a1785ec-57d2-4569-bf25-93751adf4938/red_white_christmas_lights_on_house.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.