Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://fokemale.ru/strik?utm_term=how+to+do+data+analysis PDF link annotation

  • https://static.s123-cdn-static.com/uploads/4459624/normal_5fe2802f9d73c.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4459787/normal_5ff24e7cc05da.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4403688/normal_60048fdfa7ccc.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4426547/normal_6010a23e9b76f.pdfIn PDF document text
  • http://laluwaraselolar.mywebcommunity.org/42468534233.pdfIn PDF document text
  • http://kibasemenatax.22web.org/billing_android_example.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366384/normal_600d706f7dc2d.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://4a5660cc-52a2-48ff-9acb-4b4f1704cb6e.filesusr.com/ugd/81868d_374e314ba25d4543a301d29ff6231433.pdf?index=trueIn PDF document text
  • https://a1d1c4ac-cf1d-4c58-861c-45d1188f4b60.filesusr.com/ugd/052f3a_342771d08e1d439fa5f69dfe670d4b6b.pdf?index=trueIn PDF document text
  • https://627f215e-41ba-4aa4-9906-5f9f9d117739.filesusr.com/ugd/8ab72e_6967d98caf13422d96f16ff06f1c7a5b.pdf?index=trueIn PDF document text
  • https://562c2315-396f-49d1-9e45-1236e049cb13.filesusr.com/ugd/ec0012_d278f2d509a84f6e80765a611ada7dc5.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/14dce3be-9fbe-4b5d-bebb-bceab6adbd3f/para_leer_al_pato_donald_resumen.pdfIn PDF document text
  • http://saboveliga.myartsonline.com/16545014770.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/972cb64e-016a-47b7-a72e-ef81c7b67b57/zoom_5352_bridge_mode.pdfIn PDF document text
  • http://situwosase.myartsonline.com/abordagem_centrada_na_pessoa_livro.pdfIn PDF document text
  • http://teveniwavabubak.rf.gd/wipopowow.pdfIn PDF document text
  • https://7a69a04d-b0b3-478e-a927-895b34d3dd44.filesusr.com/ugd/159848_8db8a36ca4e64c5aa9f9fe112a843e48.pdf?index=trueIn PDF document text
  • https://0ac950e2-707a-4e47-8bf4-daface0ea9db.filesusr.com/ugd/356f11_a8d6312eb1af400a9bfef7abdaace56b.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/c8bde16f-e459-4368-bb19-a17964e4912e/97637830217.pdfIn PDF document text
  • https://a5fc3680-5c08-4cda-bd6c-abaa3bdf25bc.filesusr.com/ugd/ea5d7b_c57e2aceee504191a36bedea83ed2c26.pdf?index=trueIn PDF document text
  • http://gotutopaxedirek.epizy.com/another_word_for_chaos_cody.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8b00fcb0-cbb2-4d55-b257-e97dfd78754e/bakery_business_plan_doc.pdfIn PDF document text
  • https://add83a7c-0e31-48b3-928b-061d82ba9144.filesusr.com/ugd/205ae4_bd473009167c41f39394b0a18b0fc2a6.pdf?index=trueIn PDF document text
  • http://jukikusikodopom.epizy.com/tax_invoice_template_word_doc_free.pdfIn PDF document text
  • https://f635e5d9-31b1-4f19-b758-7a623be10181.filesusr.com/ugd/6cf0f5_7594de1240fa446a9b554d45e8bf497f.pdf?index=trueIn PDF document text
  • https://02408c19-b9f6-4996-a596-1d5b7e46c8d3.filesusr.com/ugd/c83fdb_38189fa974774de68a941301b062c8cf.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.