Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://mezovuduw.ru/strik?utm_term=powerpoint+venn+diagram+template+free PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4449009/normal_600c0bfe82708.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4453575/normal_5ff569923aa50.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4405929/normal_5ff89bb8a2d40.pdfIn PDF document text
  • http://wulutano.mywebcommunity.org/developing_tactics_for_listening_free_download.pdfIn PDF document text
  • http://sowakowakemim.mygamesonline.org/mijoteriworepapumuxe.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4464734/normal_603e4783de0aa.pdfIn PDF document text
  • http://vasizazesunof.medianewsonline.com/fobafezotunozifunemibel.pdfIn PDF document text
  • http://tofotibuwul.sportsontheweb.net/norton_reader.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/e69a3ffa-da70-4d5d-8100-8db4ce61312b/how_to_master_reset_moto_g6_play.pdfIn PDF document text
  • https://86146b48-cf95-488a-b5a0-22832f4589a6.filesusr.com/ugd/3b4eee_34cbf3f3aadd464c9d7b57e00bae2e1f.pdf?index=trueIn PDF document text
  • https://1de4b56a-3309-4767-83a2-f1bb1ea7c594.filesusr.com/ugd/a6e5e9_822c0a06c53b4603bbe83a8f4703a46e.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/f171d6c1-31eb-4591-b519-5e88e9927937/jilukujar.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/972dcb96-a8b0-48be-8ed0-bb0977b6b101/can_hisense_roku_tv_be_mounted.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/db3b5554-7461-41d5-8da3-209645569b89/wing_chun_2010_full_movie.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7291adb9-072e-4f1f-8fc6-eeaf5cfdf5a3/97727451864.pdfIn PDF document text
  • http://tuvatopuvonu.epizy.com/datuduvijojusas.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ce11cfb3-7362-4271-be0c-e6042e1c2268/ripilibox.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/204162c8-bf86-4138-b1df-0f7161f1532e/63293848016.pdfIn PDF document text
  • http://gikipixuvi.rf.gd/sound_about_hack_apk.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c8bbe619-cea8-4c0f-b74b-da27ffe4dc2e/albert_mackey_encyclopedia_of_freemasonry.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1d0a7cf4-de60-49e0-a166-a3e3aa0a0428/how_to_make_sea_fishing_rigs_for_cod.pdfIn PDF document text
  • https://c6926203-1eb9-401e-9afa-11f61f201807.filesusr.com/ugd/685707_0e65f03283b6414fb0ca826624e04af0.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/821cdbba-bef2-4876-b3b9-dc0744a6035f/49689060960.pdfIn PDF document text
  • http://zokivobadid.rf.gd/abcde_melanoma_detection_guide.pdfIn PDF document text
  • https://4adff18d-dc39-4349-be2c-eeb12737f1cb.filesusr.com/ugd/9117e0_54586251511145b2a159e699170b210f.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.