Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ponafet.ru/award?keyword=atomic+structure+chemistry+pdf PDF link annotation

  • https://cdn.sqhk.co/mamidusidozu/khdp4hj/71276388289.pdfIn PDF document text
  • https://cdn.sqhk.co/nuxasedazu/ehjgin5/24079105275.pdfIn PDF document text
  • https://cdn.sqhk.co/guwezasov/eOhv2FO/68519882573.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4448536/normal_5fe4560990614.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4375694/normal_6014c7d72562c.pdfIn PDF document text
  • https://cdn.sqhk.co/zebenane/aiegehg/92428040370.pdfIn PDF document text
  • https://cdn.sqhk.co/fivodewile/7jfFiee/between_the_lines_sara_bareilles_sheet_music.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4451766/normal_602c25701a9da.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4366385/normal_5fe1c1b051baa.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://c0771fee-1ba5-4dbf-bba5-a775c3d44c03.filesusr.com/ugd/544e7e_d9f3520c876e4dacbe7aa9e61aee1357.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/7750276c-fb0c-4d07-a3cd-84d4f405642a/sakebonod.pdfIn PDF document text
  • https://4123e755-5e7e-4fb8-b167-49ba90d37259.filesusr.com/ugd/fd3290_d860ecb4142e491594c7e2296d6dbd97.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/af58366d-4b44-4a2e-8029-b29c18033a00/bow_tie_massage.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/614dea9a-73e9-4ff7-ac56-3735bbfdc3f5/dell_inspiron_n5010_battery_replacement_warning.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3c6d9b98-acdd-4130-8108-8ae90c887537/how_to_connect_yamaha_hs7_to_tv.pdfIn PDF document text
  • https://d0bf7e8b-5449-41c0-93e9-161603c0719f.filesusr.com/ugd/197ed4_802041c45f344cd985ccd958d68a19ab.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/6740bff3-08eb-4c6c-a2a5-d8925851e7d1/how_long_do_i_cook_a_chuck_roast_in_a_pressure_cooker.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f525f50a-f8ee-4587-a51d-310f7fd167e9/definicion_de_lactancia_materna_exclusiva_segun_la_oms.pdfIn PDF document text
  • https://9387bd13-3746-4408-b474-2867f26e464d.filesusr.com/ugd/ace02d_d58e3c61f1db4f92b4a4b419a44a8f8a.pdf?index=trueIn PDF document text
  • https://ee42ee57-4547-4a8c-8a66-6cccb7f6869d.filesusr.com/ugd/2a9ad2_c22428ca5643488696635e3818156dfd.pdf?index=trueIn PDF document text
  • https://ac0aa552-aaa7-40d2-95b8-1509c9da40b6.filesusr.com/ugd/7e0eb0_13337becc85c451daada8e44efd8843a.pdf?index=trueIn PDF document text
  • https://9a4b5e96-23fe-4021-9525-787506808755.filesusr.com/ugd/b3318b_5054d9a6f70a4a5a8d4dcfd2acd417a9.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/c5dc370f-9ed4-4708-b026-62f8d6adfe80/58657631596.pdfIn PDF document text
  • https://0ea28b16-58c2-472d-b6be-3e97fe9b7bb6.filesusr.com/ugd/696b8a_7c6f55b090814d2eb6c4942f26953393.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/f5df8f59-14bc-4f25-a185-6e70a336ee16/jofatiwoja.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/69672bf5-6738-4844-9f21-e622b2fa6725/25239420501.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.