Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://smidgel.ru/pbw?utm_term=main+tu+long+main+lachi+song PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4375196/normal_604197987242d.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4420917/normal_60162a50aa171.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4467043/normal_604f75b0a28d7.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4410199/normal_6045e6422c9ea.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4498645/normal_60bdcdf5f383f.pdfIn PDF document text
  • https://zogolobogin.weebly.com/uploads/1/3/4/6/134690222/677013f42f7ea.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4404124/normal_5fd7f1ee1827e.pdfIn PDF document text
  • https://mukokoloraji.weebly.com/uploads/1/3/4/1/134131612/c7ace50ff.pdfIn PDF document text
  • https://fimosezit.weebly.com/uploads/1/3/0/7/130775491/luvanudo_bobim.pdfIn PDF document text
  • https://batovidurasitoz.weebly.com/uploads/1/3/4/3/134340050/afa59867.pdfIn PDF document text
  • https://wazijewafaset.weebly.com/uploads/1/3/4/4/134437152/pujadogen-waxaxuzu-zobajevazur-sixerawatizi.pdfIn PDF document text
  • https://zisidolig.weebly.com/uploads/1/3/1/3/131379992/nisizaso.pdfIn PDF document text
  • https://zexivavu.weebly.com/uploads/1/3/4/8/134872555/673438.pdfIn PDF document text
  • https://bileravufal.weebly.com/uploads/1/3/4/7/134749654/3a7eefa4.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4486969/normal_5fceb1981c049.pdfIn PDF document text
  • https://notovozeje.weebly.com/uploads/1/3/1/3/131379031/60d5cc11b45c.pdfIn PDF document text
  • https://megefutuw.weebly.com/uploads/1/3/0/9/130969536/c5724b9995f85.pdfIn PDF document text
  • https://wawevilo.weebly.com/uploads/1/3/7/5/137511931/1009631.pdfIn PDF document text
  • https://piloseweme.weebly.com/uploads/1/3/4/4/134491853/xezalezado.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/d18b2288-73eb-4811-b41d-4ec55cd19a36/71402151454.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bdf36578-0e8a-4e6a-ab3a-5142ec01aeab/taco_bell_breakfast_menu_vegetarian.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/588c09c8-ddd0-448c-9f40-af8edc3b313c/percy_jackson_and_the_lightning_thief_full_movie_in_hindi_dubbed_free_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e64177eb-6819-472c-96a9-74fa2095eb28/apprentice_magician_yugioh_espaol.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/18c59d38-a7b2-48fa-b3d7-edadc4fc0489/90565836957.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • https://savannah.gnu.org/projects/freefont/In PDF document text
  • http://www.gnu.org/licenses/In PDF document text
  • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.