Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://baarspo.ru/strik?utm_term=apple+iphone+5+wallet+case PDF link annotation

  • https://cdn.sqhk.co/xefilelo/ZLgeJhf/fikogopora.pdfIn PDF document text
  • http://alsamcctv.com/another_eden_mod_apk_1._5._1d1pt1.pdfIn PDF document text
  • http://form-lnstagramverifiedbadges.com/lowosatojoxugxk6.pdfIn PDF document text
  • https://cdn.sqhk.co/sawijewabob/igjiGgd/zig_zag_rolling_papers_ingredients.pdfIn PDF document text
  • https://cdn.sqhk.co/bokirebi/gjqQa30/highway_traffic_car_game_online.pdfIn PDF document text
  • https://cdn.sqhk.co/moromasi/uliijbj/kitolevutujo.pdfIn PDF document text
  • https://cdn.sqhk.co/difigobon/bjdifHD/xuxivikifatulawoge.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://c1ab63b4-4781-4901-abeb-f581ed41d26f.filesusr.com/ugd/b44917_7b4688c9aeaf4dd596ac0b4bf9d84b11.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/c924756b-5a19-4fc5-a880-0de59a400819/lubevobizujim.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7b99bcb2-f426-4b24-b5b9-bcd3aa0d226f/85615134162.pdfIn PDF document text
  • https://814cba0f-f649-4223-bfe6-7884e6e02b9d.filesusr.com/ugd/c1108c_8ace95636b1a46cc851339fe7dae2533.pdf?index=trueIn PDF document text
  • https://9b08d158-0e0f-4203-9b31-e1272d977b1c.filesusr.com/ugd/086daf_dd0d3525b9414cd4a77a13b75e94ca09.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/516f6ccb-fc10-469f-9f19-8b82116f8086/nonisuvi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/92f3eae6-57a9-446d-8e90-f0d99ebf5dad/37151580912.pdfIn PDF document text
  • https://8d40832c-2e2b-4284-8151-bb35a16d80ac.filesusr.com/ugd/05d014_f810ccaff1f44e2d8d1ccd613852768a.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2be22ed9-9a7e-4f41-ac40-9aec4a561f44/frequency_distribution_worksheet_probability_and_statistics_answers.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dda112ae-09c1-4693-be75-3a6ca9865ced/geometria_analtica_steinbruch_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b5efa5c6-9bb6-4f75-a720-f337ca35b637/1817977194.pdfIn PDF document text
  • https://0d555108-1732-4721-8d72-76d747b2053a.filesusr.com/ugd/1b0481_0e6611a823f14d8cb19740063cfa9431.pdf?index=trueIn PDF document text
  • https://367e539a-c541-4439-991c-4bf2bef2aa7a.filesusr.com/ugd/77d535_b95f8e151c25454cab6b9a03c8a774d8.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/ec9adbf7-4f9e-4f21-bf40-60477fd355b8/what_does_mi_alma_reclama_mean_in_english.pdfIn PDF document text
  • https://5984e891-aecd-43e6-866f-efdb297c9c35.filesusr.com/ugd/403565_ee3559265f42459db43fb81aa73c60e7.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.