Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://druttle.ru/award?keyword=line+6+spider+3+150+watt+review PDF link annotation

  • https://cdn.sqhk.co/savunowudob/Ajdbhi6/93648578838.pdfIn PDF document text
  • https://cdn.sqhk.co/kuzosexiwugu/ihhghgr/gisasibemibesapijos.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4407085/normal_600398b082785.pdfIn PDF document text
  • https://cdn.sqhk.co/rukokota/jgg1Xk4/1476147236.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4389090/normal_5fceaa1a34f07.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4456996/normal_6030672a9090d.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4416934/normal_5fe9b66297e6c.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://7f793f8f-877f-420e-851b-8bae9ea62a4d.filesusr.com/ugd/78c764_b8b78d1d72e64664b318e3c6f2193788.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/7543c69a-8894-46a8-b7f1-1ef56817ce32/zebra_ztc_gk420d_change_ip_address.pdfIn PDF document text
  • https://0bef8565-087b-457a-960c-b0529baba50c.filesusr.com/ugd/638000_bdbdd3509f2b4d04a83b0293e6183fae.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/d1305c59-a125-41c9-be34-4c59cc8a8f5b/italian_for_all_in_good_time.pdfIn PDF document text
  • https://bac325b5-3710-4a60-ba01-c1ac5e8a7650.filesusr.com/ugd/c111de_be03a465ab0849608a9f513b600d7b38.pdf?index=trueIn PDF document text
  • https://c7fb3737-a2fb-4e06-b71d-f78b648bb0a4.filesusr.com/ugd/a9248e_c2c673c91e474753bca9969a98ee3d49.pdf?index=trueIn PDF document text
  • https://436010f1-0dd7-4950-aec0-3bdf337573e8.filesusr.com/ugd/5a4c69_3173727b86ce45d5abb3494b33f69716.pdf?index=trueIn PDF document text
  • https://1094d5c0-a920-47c7-a1de-7e2d56a92d84.filesusr.com/ugd/47b1e8_fba480d5e8dc453aa322938ad32ac138.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/4487ec88-4a7f-4a27-b39d-17025102347a/zofuxefajurubejovudoje.pdfIn PDF document text
  • http://jodofinefurow.rf.gd/alex_rider_secret_weapon_summary.pdfIn PDF document text
  • https://44f39d5c-a655-4437-91b6-62b11e148e71.filesusr.com/ugd/eb4c03_114179f565ed4f6d9a821934f69d0a6e.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/4b277a6a-7810-4f3b-8bec-7d8863783a10/89049839920.pdfIn PDF document text
  • https://26bfc7ce-baa4-43a1-9280-72312523cbd3.filesusr.com/ugd/5af86b_5936b2841e67441a9cb122f66a5029cd.pdf?index=trueIn PDF document text
  • https://e26dc784-fa46-4601-9f6d-57686faaf216.filesusr.com/ugd/c66525_b0ece6aafe734eac9301c32944839cbd.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/52cbdd9f-b08f-4e88-b4d9-4b77cc395c92/30551728444.pdfIn PDF document text
  • http://fuluputig.epizy.com/sitenunavazozibusovifo.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.