Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://lozipotod.ru/strik?utm_term=definicion+de+derechos+humanos PDF link annotation

  • https://static.s123-cdn-static.com/uploads/4473619/normal_5fcbbfeeb0c9b.pdfIn PDF document text
  • http://latuha.com/bopizeruxijedad9zxa9.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4473375/normal_5fe420c390dec.pdfIn PDF document text
  • http://energytik.net/how_much_does_it_cost_to_get_a_gas_line_installed8l2ey.pdfIn PDF document text
  • http://yogait.space/iest_std_cc1246x40af.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4391327/normal_602c29e11813b.pdfIn PDF document text
  • http://nefritthebestthing.site/gba_emulator_free_onlineodfoc.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4467979/normal_602b76eb24216.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://e905a76e-7bc1-418c-be29-e8eda1603e86.filesusr.com/ugd/3fb32a_b04c8b44880d4f65b1a532772685a150.pdf?index=trueIn PDF document text
  • https://459ec6dd-5b69-4322-a182-74abbfaa0e48.filesusr.com/ugd/221eaa_6b73b554495d47888b18ee0bc9af9ba5.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2c7706a7-3c3e-421f-a7ee-28e3e4c5134c/situvunibanux.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f7466ee3-f48a-4e16-a232-8e0db4723f8e/unterschied_cradle_to_cradle_und_recycling.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2f85d752-4ba5-45dc-aea8-bf2e1cc14127/how_to_pair_a_craig_bluetooth_speaker_cma3569.pdfIn PDF document text
  • https://835a0401-7144-467e-aacc-710587930ffc.filesusr.com/ugd/432cba_83c3ae32395f48c2bd173650b8480794.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/604679fb-f9fa-4391-8054-66ad5ac47d49/eva_luna_novela_completa_captulo_1.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/58f75173-8c79-4b2c-b033-8165fff01ea1/panasonic_kx-tem824_programming_codes.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8af26dc3-9a88-4b8e-80b1-83152a4791ed/tebuj.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d6980fa2-aabe-4ea7-9cea-07e559b4397a/67757946783.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a44e6d5a-fe74-4666-90e0-edab66fc508b/their_eyes_were_watching_god_chapter_19_quotes.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c1e2298c-9d63-4e0d-b9b7-0d8fedec4269/dakuzatelovimefenijux.pdfIn PDF document text
  • https://b47237a6-1880-4d87-9598-f01162bab054.filesusr.com/ugd/1fe0ea_44eb9510f0864d03b0082a71c4769306.pdf?index=trueIn PDF document text
  • https://8ed7ad90-0d0e-491f-9c15-1f6cd5a61d18.filesusr.com/ugd/f1a804_8a5c7de2fb1242ecb6f1bafa88a5be46.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/a4f7b973-9c6b-42b4-aa9f-afbe9fa1b7e5/what_is_the_poem_dream_land_about.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.