Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://resalured.ru/strik?utm_term=engineering+drawing+standards+manual+nasa PDF link annotation

  • https://static.s123-cdn-static.com/uploads/4461766/normal_5fef58c2ac5b4.pdfIn PDF document text
  • http://dororuminaxa.mywebcommunity.org/45834194638.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4382779/normal_600191325dad3.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4452381/normal_5fcb369032bd8.pdfIn PDF document text
  • http://vadosaj.getenjoyment.net/how_much_hp_does_a_lamborghini_gallardo_have.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4424985/normal_604347925a189.pdfIn PDF document text
  • http://xufuxenu.mypressonline.com/how_to_design_a_website_using_html_and_css_with_example.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4380525/normal_5fd6ee739b359.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4496816/normal_5feb9120f10b1.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4478398/normal_6049c85a07eaf.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4370533/normal_5fcad83c7cd3a.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4459481/normal_6052a5e9416e9.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/df9ed846-d973-4e59-a04c-0596f71b36a0/vusiridurifanezetoxes.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a42e897a-00e5-43a9-97f0-28371ce2f5d3/how_to_reset_lowrance_hds_12_gen_3.pdfIn PDF document text
  • https://2225f16e-b6a0-48e2-a067-d7e802b71dd4.filesusr.com/ugd/a7ada4_4c765e8f4e4f4fc2960a0ea3fa550975.pdf?index=trueIn PDF document text
  • https://b20aee1f-b1b7-4e4e-be5e-d884e4ece670.filesusr.com/ugd/10e3af_5c06514594d64bb98b7511748f720d41.pdf?index=trueIn PDF document text
  • https://de99c131-68bf-4271-bcef-cda292486844.filesusr.com/ugd/f5892c_9fe5b29313e1414ead4f9b7781d26268.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/c25715cb-5e13-4c2c-8e23-9dfb39992d96/how_much_does_a_sandwich_bag_weigh.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/599dffc8-ce6f-4e95-857a-13281bf42594/what_are_the_three_elements_of_poetry.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9da10b38-f70b-4cf6-84be-de9b606f13ae/xiwadawugu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/20bc0aff-d94e-4327-bcfe-a3377c2ee811/what_does_the_bible_say_about_virtual_reality.pdfIn PDF document text
  • https://f89b8795-a90f-4359-81e0-6309601a98d9.filesusr.com/ugd/8e7730_92cd1fda59f34cdf8b10e1dc41b91bbe.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/c68d4267-e4ba-4f0f-86a2-64f086bd44db/68817081470.pdfIn PDF document text
  • https://db38eef3-7d65-43a4-badd-ba39ed7d9417.filesusr.com/ugd/bd2483_b4707e853f714681a877470f794263c2.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/7df532e1-5191-4ec7-81fa-b798ed6c1aee/kisoxoxagenufezer.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c9fd7082-32d7-47b8-ad55-fd263934c2fd/what_age_uppababy_rumble_seat.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.