Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://leonvi.ru/strik?utm_term=hamlet+2000+full+movie+online+free PDF link annotation

  • http://natur-bio.space/9083192279dxfny.pdfIn PDF document text
  • http://mon-compte-cmb.best/tikuzelojezrv9s.pdfIn PDF document text
  • http://maxist.ru/man_is_the_measure_of_all_things_quoranmyab.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/96b7bc33-53fc-4eb4-8ecb-ea786ef64a48/how_much_does_it_cost_to_neuter_a_cat_in_south_africa.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/3abab266-5069-4847-bf4d-dd557011e2d6/kanso_sound_processor_cp950.pdfIn PDF document text
  • https://2061f665-9309-41a6-981d-137229ee7e60.filesusr.com/ugd/eb2fe6_c2f0bfb5108445b2b619dfa7b4c50899.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/933f23ce-c3e7-4058-b1c9-9fcf01817ccf/viva_self_clean_water_cooler_cold_water_not_working.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8cf0a860-6b38-4461-aa87-2cbf4726af00/the_education_of_little_tree_summary_chapter_4.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8dc683e9-8fb2-4754-ab32-6b8ffc630082/42728897283.pdfIn PDF document text
  • https://0e9c393c-9feb-4465-ae9d-4486bea7a644.filesusr.com/ugd/4b68be_953425af9d5c478f88fc4ea6359ab74e.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/211c5bd2-def6-4efa-9f4a-dbe381589eb8/miss_peregrines_novels_in_order.pdfIn PDF document text
  • https://569e8712-2873-4b93-a654-ea71b6b809e3.filesusr.com/ugd/345929_c22b30e049c542f4b06070702705429a.pdf?index=trueIn PDF document text
  • https://9d50af6f-dbf7-41ba-b854-83985329a12b.filesusr.com/ugd/33c377_78170424a0a747d191938b856374f0c9.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/fab3e85d-49b4-4425-aa47-8f55c9dceb92/nexupumegamujomagumodije.pdfIn PDF document text
  • https://f9fc249e-2e6a-4908-9eb0-88005465a50d.filesusr.com/ugd/2530ee_9d663e829bc9415cafe9353d66b44b7a.pdf?index=trueIn PDF document text
  • https://19a39513-20cc-49d1-a75c-e30ce0314142.filesusr.com/ugd/f99735_c189f8614e994c0c95917ee880e68ac4.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/5e70a3dc-5c19-427e-81b6-9dab7b70cff0/stihl_leaf_blower_bg_50_owners_manual.pdfIn PDF document text
  • https://ef5e9b3f-1a8e-4c79-9b60-34b8f8133c96.filesusr.com/ugd/18574e_89033b7c4c2944afb0e0e0321fd78b3d.pdf?index=trueIn PDF document text
  • https://064d663d-f6b2-44cf-a6ad-083da5f315e5.filesusr.com/ugd/77eba6_bfa8068fdaf541e393a8c0b5a11e1a69.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/8f952597-aa99-47fc-a9d2-dd29b9634023/how_to_cite_a_case_study_in_apa_with_no_author.pdfIn PDF document text
  • https://46c19374-600d-43be-a5f2-d8bf07c6fddf.filesusr.com/ugd/cc94a4_8ac2f929db6d456b98e8a9712675d8f7.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/10a90ff9-254c-4275-8efc-7fdb49fc42eb/roremabobixusuwa.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.