Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ponafet.ru/wix?keyword=game+apk+mod+offline+unlimited+revdl PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4389599/normal_601b454dd62c2.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4386622/normal_603391fe89f71.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4420745/normal_6035c69cab5b8.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4368475/normal_60404dd15d538.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/sewamos/how_to_calculate_transformer_kva_to_amps.pdfIn PDF document text
  • https://s3.amazonaws.com/xeropizuwe/add_items_to_combobox_c_winforms.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/4964c138-2c8d-4ad9-b8a6-2a80aac3850c/pisomum.pdfIn PDF document text
  • https://11ab4cf5-156d-4417-99e9-5039b2a7eb5f.filesusr.com/ugd/82d61e_bfddcd726ab348eabe9660dfbda89a83.pdf?index=trueIn PDF document text
  • https://5f8b0e40-2141-4341-98ab-6145db4b8156.filesusr.com/ugd/2072cd_eb49e71aa4d84884a8f8b742f91fa398.pdf?index=trueIn PDF document text
  • https://40e214c1-1950-44e8-a195-e2c6eeb23253.filesusr.com/ugd/a517f4_5a70f85fd0844c6db6e3da3ebe0fbc76.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/purufiz/25443924079.pdfIn PDF document text
  • https://a86a6b26-b473-4b55-b9aa-7628a2bff077.filesusr.com/ugd/4f270c_5a783534e55a4321bdfdb07723680f40.pdf?index=trueIn PDF document text
  • https://9fc80a0e-b25b-4135-afeb-9811a1ea6bf8.filesusr.com/ugd/91e123_4a010ae19fd24a4da4f87dafe8ddf719.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/5c6c3b19-ffdb-4350-958e-a4a27ef1012e/how_do_i_reset_my_lg_sound_bar_without_the_remote.pdfIn PDF document text
  • https://s3.amazonaws.com/kefodek/econometrica_editors_report.pdfIn PDF document text
  • https://6d4a8fb0-9a8a-4850-8aa1-2b5706121c9a.filesusr.com/ugd/ff2e72_026b9dd9efdd43a284c707455ff325a1.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/f3b4db8e-b8d1-4404-ba0f-b1434ed0d4b5/viper_7856v_remote_lights_flashing.pdfIn PDF document text
  • https://f9a132f0-acc9-4761-b7d8-38025aedd849.filesusr.com/ugd/5c71d6_48f84a0b60dd42989056ac2e17263135.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/124c053c-4918-4583-8e2b-b449d6465466/navy_ship_approved_boots_for_type_3.pdfIn PDF document text
  • https://d1897088-ef6e-4b60-8303-910b4b551fc1.filesusr.com/ugd/4cfbbd_0aa6a5fdf50c4ddba030fedf181b09a3.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/5d0ee619-69a2-4490-85f4-78f165ba58ac/example_of_letter_of_interest_for_a_job_position.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.