Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jottigo.ru/123?utm_term=bubble+bubbles+game PDF link annotation

  • http://parhelifrl.space/united_states_military_rank_insignia_chartqkdbi.pdfIn PDF document text
  • http://forpost-electrica.ru/naxomafevuku0iwpa.pdfIn PDF document text
  • http://mrt-zdes.ru/fisiwezisexixemozadopifa3svg.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4383308/normal_5fdc6abe0d7da.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4502567/normal_6010461e91db3.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4370528/normal_600cdfa888b7c.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4455660/normal_5fd631aa57c78.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4480408/normal_5fe0858af0cee.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4367944/normal_5feafba001c2b.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4498345/normal_5fc8723c7b03f.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4427085/normal_603bbc029282b.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4391303/normal_6051ad80e0e7f.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/d5f98b6e-0b54-4a8b-a294-60d35be93ea1/voviritukusujonorizine.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2c045dd5-c027-4c07-9266-eb15b1c2f669/nupofazik.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/eace80d1-4af4-477f-b4cf-4f5b57762812/51891821104.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/724b7658-9140-4f5a-af87-a3a5eb614380/what_streaming_service_makes_the_most_money.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/cbc58681-792b-4d82-a940-34974bd6d83a/la_la_land_piano_duet_sheet_music_free.pdfIn PDF document text
  • https://5984e891-aecd-43e6-866f-efdb297c9c35.filesusr.com/ugd/403565_f023d5deb5b142fca40e97773d004ac2.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/730e1518-c23b-4b28-a6a3-4381bb4f7f2f/16236572856.pdfIn PDF document text
  • https://00407fa8-a9ef-4b78-9bbe-46147fc8acf6.filesusr.com/ugd/5ecadc_2992e36426ed46dc84d190b869083387.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/59694436-d7d6-42fe-a4cb-be9adc4032f9/juegos_del_hambre_2012_pelicula_completa_en_espaol_latino.pdfIn PDF document text
  • https://02ee9779-94d6-4ec7-959f-c0f99fe19a35.filesusr.com/ugd/cdc607_a30770f7762149cd85b2b67d38d63bf2.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/6c950107-5225-4422-9d1c-c61513bc76b4/62805528433.pdfIn PDF document text
  • https://bcbc83ff-a82b-4234-bf1d-c69e8cae54d5.filesusr.com/ugd/057c82_dbce15cfe8f14ae98d5c2b224f26c74f.pdf?index=trueIn PDF document text
  • https://d1897088-ef6e-4b60-8303-910b4b551fc1.filesusr.com/ugd/4cfbbd_087b3758a6854413b0fc921d2dd92c4a.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/845a91d6-7370-41d7-9bf3-36922506ea62/somewhere_over_the_rainbow_original_ukulele_chords.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.