Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://maypoin.ru/strik?utm_term=can+police+recover+snapchat+messages+2019 PDF link annotation

  • https://sabazufolitok.weebly.com/uploads/1/3/4/5/134585121/kuxujato.pdfIn PDF document text
  • https://cdn.sqhk.co/pejasibupap/gjjejid/80185042061.pdfIn PDF document text
  • https://cdn.sqhk.co/xumesapaxoku/dB9igbk/ancient_bricks_hack_apk.pdfIn PDF document text
  • https://pabidiwamudobav.weebly.com/uploads/1/3/5/2/135299897/wukigazima-rebixadaderiven-toremixiroko.pdfIn PDF document text
  • https://cdn.sqhk.co/noxisoture/gh1r916/dragon_and_elves_mod_apk.pdfIn PDF document text
  • https://xazowivuxef.weebly.com/uploads/1/3/4/5/134513065/dijutorugizaxedimuna.pdfIn PDF document text
  • http://dabosesavedevet.medianewsonline.com/aptitude_test_formulas_free_download.pdfIn PDF document text
  • https://vavimogazoru.weebly.com/uploads/1/3/5/9/135968849/gusarijez.pdfIn PDF document text
  • https://cdn.sqhk.co/gejixoneku/ibHsgdN/92945432690.pdfIn PDF document text
  • https://nafufarub.weebly.com/uploads/1/3/4/2/134266214/karagisolu.pdfIn PDF document text
  • https://cdn.sqhk.co/bibobovezave/egeNgdL/online_english_learning_games_for_kindergarten.pdfIn PDF document text
  • http://zugugalepew.mypressonline.com/the_economist_2020_vk.pdfIn PDF document text
  • http://maxirem.mygamesonline.org/wiring_diagram_for_coleman_mobile_home_gas_furnace.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://245ae9ba-e923-43ed-bc11-30ed5d1acd78.filesusr.com/ugd/051519_520a82d68c34470e982d62c414699121.pdf?index=trueIn PDF document text
  • https://4c69d07c-928c-405f-a1ab-6436392658c4.filesusr.com/ugd/4c264d_b293e80ccbba441f8274ff6df4bf0b91.pdf?index=trueIn PDF document text
  • https://63995da9-74be-4895-8497-a4fa53c9845d.filesusr.com/ugd/788c84_6ef2119a10a44ac8852c4adbc0bae086.pdf?index=trueIn PDF document text
  • http://kepawomokatuke.myartsonline.com/2404921418.pdfIn PDF document text
  • https://0dc5016f-38c0-4e11-84f4-4717e3ef4ec7.filesusr.com/ugd/4fd84c_9b7e8e014a5c47f6beea537282331396.pdf?index=trueIn PDF document text
  • http://jezevenakos.myartsonline.com/73472064487.pdfIn PDF document text
  • https://f72b89be-0fa6-41ee-8162-331329ef78ce.filesusr.com/ugd/95089d_f5afb32a87db4ebc968cbbee020a16d5.pdf?index=trueIn PDF document text
  • https://63c031ef-a76e-4574-b6c7-b683c5cdde0f.filesusr.com/ugd/3a5e7a_1ac126205d3842ef88120f999d5d56ab.pdf?index=trueIn PDF document text
  • https://2a403a33-5f6e-4534-96f9-742aa7325afc.filesusr.com/ugd/d2da83_8157b1429e404604a099a40b4466a9c6.pdf?index=trueIn PDF document text
  • http://japinoxizidunub.myartsonline.com/migare.pdfIn PDF document text
  • https://96a9e3af-f0c3-4048-9e6c-0ad8da3c6018.filesusr.com/ugd/15d534_d8742e2e786b404baea45bf53f01effd.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.