Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://resalured.ru/strik?utm_term=sig+sauer+p226+airsoft+manual PDF link annotation

  • https://xupajipodiburut.weebly.com/uploads/1/3/0/8/130814024/2614337.pdfIn PDF document text
  • https://cdn.sqhk.co/jukunobegabe/hic6Fij/cafeland_world_kitchen_pc_download.pdfIn PDF document text
  • https://cdn.sqhk.co/waxipefimafa/iegjhkq/origami_ninja_star_easy_step_by_step.pdfIn PDF document text
  • https://cdn.sqhk.co/watexoba/ghCIiie/asphalt_nitro_online_hack_tool.pdfIn PDF document text
  • https://cdn.sqhk.co/nufesewepi/eu6igjc/33654960759.pdfIn PDF document text
  • https://cdn.sqhk.co/kisunika/Ajiihbx/89799694133.pdfIn PDF document text
  • https://cdn.sqhk.co/ximegawaso/iejch4I/artecture_draw_sketch_paint_apk.pdfIn PDF document text
  • https://cdn.sqhk.co/jipodipotaj/ggehiV5/breville_pizzaiolo_vs_roccbox.pdfIn PDF document text
  • https://mawetifatine.weebly.com/uploads/1/3/2/6/132683292/vezulatefobiso.pdfIn PDF document text
  • https://sapuvitajesi.weebly.com/uploads/1/3/0/7/130776539/4672324.pdfIn PDF document text
  • https://cdn.sqhk.co/tawavumazo/bgfgjib/u_mobile_centre_kuantan_parade.pdfIn PDF document text
  • https://cdn.sqhk.co/tasokuxu/m5XDbo4/xoredijuvaz.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://6997f972-013f-4c6f-ac95-4179ba17a557.filesusr.com/ugd/549e1a_78e4cfedce2e401db7f493079db2b5ca.pdf?index=trueIn PDF document text
  • https://8eefcaf3-52f5-4123-8be5-b1f0aaeea45e.filesusr.com/ugd/1d3654_0f8b13eb6b4c4764b1704bc5d4abfd85.pdf?index=trueIn PDF document text
  • https://0c43c058-97b3-435a-b041-a9f001bfa883.filesusr.com/ugd/791d74_1332d4af01bd4e9da36d7159da750c84.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/b8433fe1-fb27-4fe6-bc4f-3bc8fe425563/22640701915.pdfIn PDF document text
  • https://29159626-56e2-4eb2-a8c1-eb081f451e44.filesusr.com/ugd/a58502_bb5226b274714f80a7fbb7c311a708b4.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/e4b80db7-d56a-4387-af05-454cf0bdec69/jawinedofili.pdfIn PDF document text
  • https://ad323f3e-245e-4e3c-8b16-de91fefec063.filesusr.com/ugd/5ea691_6621977213f7431e97e2c500a0d1c492.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2e4e65d4-5d6e-4510-8a68-3afa5be9455c/how_to_reset_a_centurion_gate_remote.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3454d4d0-193e-4147-8b66-c071c4257996/wavibewakenorilaxu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/57d3aa39-1e39-4ab1-8972-67f17fd66936/20204294059.pdfIn PDF document text
  • https://36622f5a-5a1b-41a5-aa98-965156e47ac2.filesusr.com/ugd/804ff6_a8e848e7cd50409ab2497884f1bd9f8d.pdf?index=trueIn PDF document text
  • https://4bf641bf-117a-4913-931f-55e49063997f.filesusr.com/ugd/5befcb_0c7b16ff06b84dcebed1d0ca804defff.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.