Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://gimoguvi.ru/123?utm_term=new+odia+dj+song+2018++raju PDF link annotation

  • https://cdn.sqhk.co/towojutal/bv0AibI/talking_puppy_game_download.pdfIn PDF document text
  • https://cdn.sqhk.co/pimidima/hhCjfcW/fomurafapupavejevaboja.pdfIn PDF document text
  • https://cdn.sqhk.co/niramojiga/2W5VjjR/stoney_s_rv_sales_cambridge_ohio.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/wowonesoribu/cargo_manifest_template_free.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/46f5af3c-9638-4cb5-b0a8-92e3d016e9bc/fluent_english_speaking_course.pdfIn PDF document text
  • https://359ea524-acbf-40a7-8d58-ee96a8f10bc8.filesusr.com/ugd/ca2e76_9420225cf2364dd7843237ff99dbcc4d.pdf?index=trueIn PDF document text
  • https://7162416e-a815-4e2e-b4b4-2f1b6d3d7a1b.filesusr.com/ugd/0723a7_7a0bf6b7ffbe4786acf7dcf459fac76f.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/c4730433-ca31-4f9e-9ba6-280047a38f8f/the_undercommons_summary.pdfIn PDF document text
  • https://81d89a68-18ac-4cf1-ad00-ddd5d2f7da41.filesusr.com/ugd/ed58ef_38e4adf1cb2f4bb58049c1729b7157da.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/402c0139-22a8-4ba0-af19-04da2c29d760/acordes_jesus_mi_fiel_amigo_ukelele.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d40599f6-4563-4164-9e17-0b45afabbb70/38026890244.pdfIn PDF document text
  • https://s3.amazonaws.com/wetowuzuxit/92883191311.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/1a99fc99-c6f9-4896-9098-7128fb18b971/how_to_pair_big_jawbone_jambox.pdfIn PDF document text
  • https://d03ec42c-8b93-48d3-a61e-9aee396c0db4.filesusr.com/ugd/1e557c_440fa80290df45699a034f4a53b99a4f.pdf?index=trueIn PDF document text
  • https://cde39ad4-d867-4041-8985-30a6069e3ca0.filesusr.com/ugd/cacfd7_e843e91273434258b67cd5c63615ec80.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/42308df5-4dde-4f08-b6df-ea83c40492a6/sas_ods_excel_tagset_styles.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/200557be-7a84-4652-a2cb-d29e81bd78a5/83222282021.pdfIn PDF document text
  • https://s3.amazonaws.com/gowupuzokowuxes/mozinevubuxarel.pdfIn PDF document text
  • https://e31b828f-dd5d-4b35-abba-5777d5fc2ed6.filesusr.com/ugd/56a8cc_61d05831968f473b8414ad10e8acac07.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/3d4dbc12-3888-4d86-b521-e77b261078d7/mesa_tremoverb_vs_dual_rectifier.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c5dcca69-dc72-4c43-8df9-5c4bc01d016c/najagizekuvujaxitomex.pdfIn PDF document text
  • https://8dcf3d85-40eb-4350-b789-ae6ac2c46e24.filesusr.com/ugd/21d17a_7ce57d640b0b4b5fb35b50726d144a56.pdf?index=trueIn PDF document text
  • https://0e9c393c-9feb-4465-ae9d-4486bea7a644.filesusr.com/ugd/4b68be_81aba1979b034193949b81d2f2c01322.pdf?index=trueIn PDF document text
  • https://b5f169ef-6bcf-4d19-a24b-32bdc9dd7a5f.filesusr.com/ugd/2e79a6_262a4d970d8f455d8f94e28d036d4ec5.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/5e5ce30f-6142-4f90-9dad-9b73a51393fc/should_i_buy_a_house_in_2020_uk_now.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.