Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://resalured.ru/strik?utm_term=safe+haven+sales+rep+salary PDF link annotation

  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://025b4bf0-2906-4f5f-8a0f-6d4b68fc9518.filesusr.com/ugd/148ee2_0412822ca7e5495ea4d048418a5642f1.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/432d8749-c320-480b-842b-9018fe6930c8/digital_marketing_plan_template_word.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d060644e-540b-4722-9834-8edd4f6330f9/beethoven_piano_sonata_no_19.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/06612715-465c-4215-b016-3bc4022383fe/bilarazuvuguguwavopuja.pdfIn PDF document text
  • https://0dea665b-aaaa-42f3-a52c-f86f0fd1efa2.filesusr.com/ugd/8b9728_29acd6ea1e8345eda2d7c85a029cc9a1.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/61929b0a-7ab6-45dc-af15-e1a6746720b3/15562238571.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/26e2e161-8f0c-404e-97bc-c31471757de9/rorifavikovukagupobevizo.pdfIn PDF document text
  • https://aa4c2489-c93b-4667-afab-104bf5323bad.filesusr.com/ugd/8b49c6_96ff49901c6d43eebf080e6909bb0359.pdf?index=trueIn PDF document text
  • https://51da6a7d-ee05-4a49-87ee-1b74af3aeb07.filesusr.com/ugd/b80405_ef93bd2a20014f00a06f7adb46bd65d4.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/9b0a0d30-44d7-4255-8934-25b6d50940cd/should_i_do_crossfit_and_lift_weights.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bbcc6827-78a0-4219-b7d6-b2cd5b87e30e/what_size_is_20_x_30_cm.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d7c8c43a-0898-47e8-bff2-e9ae477695f0/ironman_inversion_table_with_memory_foam.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/42f127f9-4f19-49cb-87da-75084a7bce4e/vetigipo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bad6005f-ee11-463d-8fb9-84b24f2edf74/rurezifin.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3ac2d1f6-8f27-46f2-9a39-e9fde45b7927/kenmore_canister_vacuum_parts_model_115.pdfIn PDF document text
  • https://5c71d6b4-13b5-43a2-97a4-9a0eba4d0f4d.filesusr.com/ugd/0f1814_ea02b9672ba344019fed79c97facfb43.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/41cf79cb-b63c-464e-92f2-6aef7609db66/special_relativity_equations_velocity.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a3eab975-3973-4be4-9d94-b8c6112f07e8/who_are_the_main_characters_in_the_story_the_lottery.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/96bde409-4237-441d-b625-f5bb7997b1aa/foucault_the_history_of_sexuality.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9cbaebdb-5cbd-44d9-9507-9b8096838333/52775689828.pdfIn PDF document text
  • https://59bb578d-b312-442a-858b-1a1a54b18a6c.filesusr.com/ugd/c79b1c_fd26320cc9ab4d659b1158c8b915600a.pdf?index=trueIn PDF document text
  • https://1d812fcc-cfc3-4558-a870-56fc5b7f4c2e.filesusr.com/ugd/754d94_169350a5e5d24a00b1ff01bbdac6ecbc.pdf?index=trueIn PDF document text
  • https://5be7aec3-7d66-433b-ae1d-2bfb807ddf2a.filesusr.com/ugd/24deb6_1d1ed47498fa430f98bed8712e507f23.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.