Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://lozipotod.ru/strik?utm_term=what+is+common+coding+theory PDF link annotation

  • https://static.s123-cdn-static.com/uploads/4446930/normal_5fe2638178ba3.pdfIn PDF document text
  • https://cdn.sqhk.co/dutebevon/ifnGraH/game_of_thrones_hd_wallpaper_download_for_mobile.pdfIn PDF document text
  • https://cdn.sqhk.co/ruxebiseso/xhAekge/13143582921.pdfIn PDF document text
  • https://cdn.sqhk.co/wotirixa/Pfgc8ii/32620825903.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366666/normal_6068c4bdc0e42.pdfIn PDF document text
  • https://cdn.sqhk.co/savujegu/Y5jagcF/jipapamaxotaw.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4498868/normal_5fe021fcdbcd8.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://uploads.strikinglycdn.com/files/8f560b18-9d54-403b-abae-d562c92e7aee/what_is_the_meaning_of_unity_in_art.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/263fd449-3548-43eb-8f78-85bfae89f62d/cabin_sketch_font_family_free_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/63e5e50b-87be-4b37-9a36-472f959b3d2a/jonesov.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9edbd9b4-1a95-4659-823a-3a02b492ee90/84970099363.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d46bced3-50f0-4460-ae77-5e6aee4f940c/tinosifewogusipir.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/17aff337-c183-4424-88d4-655572418ceb/43008315044.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/eca764b0-8433-49d3-a611-33834834ee54/nudosalixefufinibiwaxewe.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8c5c6bf0-2c78-4677-81a6-1e4b34baf1e3/natotibupivama.pdfIn PDF document text
  • https://ecf8b3bd-8201-449f-a39c-156acd88681e.filesusr.com/ugd/97634b_e7ea3d6c1be94fda8db5857225402b42.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/d8847cd9-66af-46d4-b07e-e103501c00d6/takonuvizulogov.pdfIn PDF document text
  • https://425e2ee7-996f-4c6d-a593-b44a2a39b733.filesusr.com/ugd/bb05c1_62d4778d00f24feca4cca88623052099.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/efb28137-00db-4a08-af40-d9da9b1f8539/qu_tipos_de_grupos_sanguneos_existen.pdfIn PDF document text
  • https://580b68e3-2104-4118-ae5b-4f285de1c062.filesusr.com/ugd/dad7b5_87cdbec767704bd4882067636b322c1f.pdf?index=trueIn PDF document text
  • https://15e12281-0fef-4bb1-b284-2b61ddec1698.filesusr.com/ugd/6c5390_73ade5e064804a2eaae2f2db270a7792.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/d81e077f-6636-4fec-ac08-a1257dd25fbb/pamobibipabelunelatezomeb.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b9620017-e618-40b8-95cb-482e1f2229f3/what_type_of_intermolecular_forces_exist_between_nh3_and_hf.pdfIn PDF document text
  • https://da550aaf-34ae-4f9b-ad82-7836b82beebe.filesusr.com/ugd/a203e6_3f4e6e1137f940cebd4759f8aa594b33.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/9b84eef7-c66c-415d-b985-2703980c2c39/how_do_i_fix_my_acer_laptop_without_power.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.