Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://lozipotod.ru/strik?utm_term=fifty+shades+freed+full+movie+story PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4475379/normal_6041753d6755b.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4389805/normal_6037884a752ed.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4378623/normal_6054ed8feb6bf.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4411001/normal_5fd095e19a1e6.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4392867/normal_60418bc6cfb77.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://2489a575-72f7-492f-b117-28cfe4a4d2a3.filesusr.com/ugd/d81705_7706fbd488b441b892bffb10aea5b70d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/4b409930-9227-438a-a8a6-77073aeffc7c/2013_dodge_avenger_se_rim_size.pdfIn PDF document text
  • https://7e005a1c-fb68-43c1-af83-b854b6a2d282.filesusr.com/ugd/dcfb95_88ded0fa94b548218391877cb45b3eac.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/xokebore/fabadobalasivoxidal.pdfIn PDF document text
  • https://6bc61794-ec17-45f1-96eb-8bed4cd57308.filesusr.com/ugd/217b8a_e8e7bae06218422bbf6b8adcb5f47e6e.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/54257576-9c4d-4f98-85f9-8285d1d95d08/34369543611.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/16021957-f035-4e31-bd34-85e9ad127fa3/tabla_de_verbos_regulares_conjugados_en_espaol.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a9ed057f-c417-4a8f-bbbc-316e276a8c66/twilight_saga_full_movie_online.pdfIn PDF document text
  • https://s3.amazonaws.com/susonanezaj/xofovukifapoxabajesita.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4b033ccc-455b-4698-92cf-76f0aecce71e/70183419381.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/347b9728-7c0e-4ca7-b35a-fffd1d73baaf/city_of_ann_arbor_zoning_codes.pdfIn PDF document text
  • https://s3.amazonaws.com/jaxesabi/cash_book_three_column_format.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fab24e99-50d2-4518-a495-4f54f922a87f/2011_victory_cross_country_service_manual.pdfIn PDF document text
  • https://d64d5b41-a66a-4b78-b87f-0feaf8e9cf76.filesusr.com/ugd/cf1aed_301124c147f748dd9521622e58619331.pdf?index=trueIn PDF document text
  • https://13adc596-845f-4f4a-b539-e2c04a0a4b5a.filesusr.com/ugd/6e2da7_412169ca6180428eb70fc532bca3d19f.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/b5601e71-dde1-43d1-adfb-fdc41c0a740b/what_is_the_purpose_of_academic_text_in_academic_writing.pdfIn PDF document text
  • https://01c19f78-c7d0-441a-b56a-8672493f87de.filesusr.com/ugd/9d66c7_6f0210f3048b4d1f92c8d52c169f66fc.pdf?index=trueIn PDF document text
  • https://3e1d1bad-f645-4ebd-ac75-469e7ff7c972.filesusr.com/ugd/e745be_e12967a347684bd7a66edb4e1fd3736a.pdf?index=trueIn PDF document text
  • https://c4a5d104-04f9-44e6-b03f-1f5edac3680f.filesusr.com/ugd/f23921_9c5c1fed683c426aa369117b5732cf15.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/20aaa9f5-c361-4d54-a439-ca2335290b50/alexander_the_great_movie_watch_online_free.pdfIn PDF document text
  • https://s3.amazonaws.com/nitirew/pichuva_kathi_songs_isaimini.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.