Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://baarspo.ru/strik?utm_term=how+to+reset+service+engine+soon+buick+rendezvous PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4407552/normal_6049d224b420e.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4498893/normal_5fcab7a3d9395.pdfIn PDF document text
  • http://lynciguest.com/90963883124y9vff.pdfIn PDF document text
  • http://smartbright.club/82043499416of6a.pdfIn PDF document text
  • http://trysalon.xyz/managing_complex_change_ambrosev7kl9.pdfIn PDF document text
  • http://esagafow.fun/42131675747t0l7g.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4468819/normal_6003268826947.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://b7af6bb9-01eb-4839-ab56-764651de4344.filesusr.com/ugd/2486b5_cc36dddf2cfb40f39d1558f59f351a08.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/7b5c37e1-d510-4b09-86f7-352eb7fc9e8e/zegobe.pdfIn PDF document text
  • https://7e574f8b-ef34-4833-8dee-b18f3ac9fc91.filesusr.com/ugd/af8ffd_be6bb3053b3349a782fe633c25714846.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/2018a2e3-9800-43b1-a1e5-69be6221b9de/how_to_reset_a_samsung_tab_3_to_factory_settings.pdfIn PDF document text
  • https://33fe1336-4051-433c-b691-b763732126dd.filesusr.com/ugd/6c8f37_09a6f47d98f74c9e95c008fedd5080b7.pdf?index=trueIn PDF document text
  • https://c6506652-bf5e-4f52-be36-03dbfaede22c.filesusr.com/ugd/f74919_d6e21329e3134a58a0d01a311578a47f.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/5962868e-9824-4777-8d71-2d632c75d033/what_is_the_ute_tribe_known_for.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/335761b0-8f32-4d33-93a1-1da2d8f567e5/terigoz.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dfae2f0d-524b-420f-8e35-ed4dada7377c/what_is_a_hypersensitivity.pdfIn PDF document text
  • https://810dce77-56ab-4324-823a-3549757f4eab.filesusr.com/ugd/1fad07_dc58b229059f4153b9cce4bb733205b0.pdf?index=trueIn PDF document text
  • https://b3d988c2-7a7d-4c3c-9141-221b6550481e.filesusr.com/ugd/9dda13_f6158b3f82774faa98ebf77369956770.pdf?index=trueIn PDF document text
  • https://ff5d1526-1eb9-447d-8915-67ca9933f1b4.filesusr.com/ugd/9565fd_11d87e7d6bd04a44a56338f24f76241b.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/81807221-ac35-4803-8fcc-5d60e649a6f8/15836849381.pdfIn PDF document text
  • https://4adff18d-dc39-4349-be2c-eeb12737f1cb.filesusr.com/ugd/9117e0_ff86a28cda584fc69e2c2e488ee8e9b6.pdf?index=trueIn PDF document text
  • https://443275ec-395d-4f86-84c9-2ed7a250e117.filesusr.com/ugd/7d471d_07f06ef4c46744f280145a04f7aea11d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/3afdafc3-f645-44c2-971b-b248b783a9f4/que_es_la_composicion_plastica_y_artistica.pdfIn PDF document text
  • https://95049c82-e412-4913-a0b0-e03e83d5170a.filesusr.com/ugd/127d6e_ff06179c09844835a619b6f017eafd4c.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.