Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://golowaki.ru/wix?keyword=how+to+calibrate+iphone+touch+screen PDF link annotation

  • https://cdn.sqhk.co/jenireni/MhfDCYb/car_racing_games_for_pc_2gb_ram.pdfIn PDF document text
  • https://cdn.sqhk.co/bufutoje/geVFeo1/world_war_z_2_game_trailer.pdfIn PDF document text
  • https://tojawejememu.weebly.com/uploads/1/3/2/6/132682640/vexesizotaved-rosusotelopu-zifunixinudanaz-fuzixipu.pdfIn PDF document text
  • https://wavenugila.weebly.com/uploads/1/3/4/8/134852162/8831622.pdfIn PDF document text
  • https://cdn.sqhk.co/fabunavaxa/gMmx7jc/gobeluvoxozomif.pdfIn PDF document text
  • https://pejolufuti.weebly.com/uploads/1/3/4/0/134018137/8475872.pdfIn PDF document text
  • https://cdn.sqhk.co/nugunexinazo/jgzlYWt/virtual_dj_sampler_effects_free_download.pdfIn PDF document text
  • https://cdn.sqhk.co/lugizumevemu/ihgdqjb/34235666062.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://44f39d5c-a655-4437-91b6-62b11e148e71.filesusr.com/ugd/eb4c03_7beec73c4edf409f81f2fe969aac1237.pdf?index=trueIn PDF document text
  • http://zijisulejemam.rf.gd/68763162055.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a511d1b6-ac73-44e9-b0ae-0d1d32c95dd1/10356438017.pdfIn PDF document text
  • https://19e6fc83-c281-4d06-93fd-e8b16a02b90a.filesusr.com/ugd/ce5d00_b9366cff3d284a1d8d7202497fc880f7.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/af224a5b-daf8-45ad-9872-631481a6c5f6/what_is_heat_exchanger.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/acfe543a-fef0-4359-996a-041b4b829a97/brother_pt_h100lb.pdfIn PDF document text
  • https://30b7a97f-6117-4fff-8876-4b3c2220b6c6.filesusr.com/ugd/15cd4d_071b17e6ce4a4ef89295784b15fd1a81.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/932a02c3-76ec-4a04-9f3f-39c3e03067e6/juboramalukimiridoz.pdfIn PDF document text
  • http://lagadasisipas.rf.gd/vmware_horizon_view_deployment_guide.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ef4577e8-e3e4-4b77-a00d-1b3ee6a581e2/45475392255.pdfIn PDF document text
  • https://ef733714-782c-48ea-8991-1bc0bf0c95f2.filesusr.com/ugd/ad2ade_bfc4fbf37930415784737c6b0c3e8da8.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/10c2d936-1a2e-49a9-8b2c-697fd9c5ba81/84851558923.pdfIn PDF document text
  • https://bf68d742-fb98-404a-ab47-1dcf24f7df52.filesusr.com/ugd/83e7fd_5514948c24f0477c97cf8ce820c3e00b.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/a0ef5e91-95fe-424e-b575-19869349377d/polk_audio_surroundbar_4000_bluetooth_pairing.pdfIn PDF document text
  • http://nejotuwusa.rf.gd/wukuzilumuvumibojun.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.