Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://resalured.ru/strik?utm_term=what+do+greek+and+roman+gods+have+in+common PDF link annotation

  • https://cdn.sqhk.co/feketukadoz/hhc1rjg/power_audio_music_player_apk.pdfIn PDF document text
  • https://cdn.sqhk.co/mavixuwaloz/hcggYNd/black_friday_sales_on_down_comforters.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4495039/normal_601415bd652c9.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4478703/normal_5fe1f950f091e.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4368242/normal_5ff60b56c5de9.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4454808/normal_60003752ee993.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4473632/normal_5fcac8addf0b0.pdfIn PDF document text
  • https://cdn.sqhk.co/vatomepipiw/ftnZWzm/data_worm_app.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4413474/normal_5fe4801ede476.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4482399/normal_605afb59dcd55.pdfIn PDF document text
  • https://cdn.sqhk.co/xovikojux/giTgfhd/xakofapus.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4485313/normal_602c42d509f5d.pdfIn PDF document text
  • https://cdn.sqhk.co/tivinarafuvu/ihigibt/labazitozefumorugamozoto.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4404296/normal_6043b7483e45f.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/a477f693-8c22-4078-ba6c-5e6c764c58af/besosubiditizekeweli.pdfIn PDF document text
  • https://03386fec-e341-46be-bf9f-2f2bd19f9bfe.filesusr.com/ugd/bf57b5_13c56ae6b9dd49869720fa40e8a3a48f.pdf?index=trueIn PDF document text
  • https://cb47f074-0476-4434-b381-5672a365cab8.filesusr.com/ugd/c46c8a_fd92ff2b05c94fa798f0f790608fad1a.pdf?index=trueIn PDF document text
  • https://1bf92926-22d0-44a1-94fb-b51843c41cd5.filesusr.com/ugd/762c1a_16b39040d6ae44e3a0b6fa51428defe7.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/ad90765e-397b-4045-933b-4d5ab0c88f7e/zitagomawejes.pdfIn PDF document text
  • https://5f98d79b-b704-4ecc-a618-200e52db7f79.filesusr.com/ugd/d1a5b7_a08e41f343664da29a230a3631d2145b.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/12c4dd38-ab1b-406e-8ab3-9520832ff277/les_miserable_musical_script.pdfIn PDF document text
  • https://8137cd1e-393d-4948-8193-eca935452849.filesusr.com/ugd/756799_edbb31e15cdb44e5b443c532823e9a34.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/45abd271-6505-4095-a9fd-75055998cf79/canon_ip90_driver_mac.pdfIn PDF document text
  • https://df6a9abb-74f3-47e1-b359-fe6d1019da36.filesusr.com/ugd/7921d2_d8eeb63f879b4028a5f93486eaf6adbc.pdf?index=trueIn PDF document text
  • https://f45985d3-969e-4a4b-a16b-f92b7c881388.filesusr.com/ugd/20da2d_868e4c4f024349cd926db2e1eb910f4c.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.