Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://bologen.ru/123?utm_term=thickness+of+1000+sheets+of+paper PDF link annotation

  • https://cdn.sqhk.co/kinubowa/f5gihc6/59979335081.pdfIn PDF document text
  • https://cdn.sqhk.co/vasegodesazu/87r4Cjd/download_game_cheat_dragon_village_mod_apk.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4450728/normal_60209a962dbfc.pdfIn PDF document text
  • https://cdn.sqhk.co/xeloxilava/gcjgjiM/blacksmith_tongs_amazon.pdfIn PDF document text
  • https://cdn.sqhk.co/talurelope/hKgiDig/30418355007.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4410722/normal_604f61ca54f4d.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4464070/normal_5fd64317c4a05.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4374852/normal_601621a46f10c.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4377371/normal_5fd9315c350ec.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4469101/normal_604aa85e9450f.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://7e62deb9-9b1a-4e2d-8b60-9a8f762ee201.filesusr.com/ugd/1f553f_ce82181d283c42d8b73e7d73d8fe0ea7.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/30bb9336-3073-47ee-b145-c1be4f58194d/95307137181.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fb5cbd2d-ee57-4ee8-85ac-045e0d2627d3/what_are_the_angles_formed_by_parallel_lines_cut_by_a_transversal.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d3a44e5a-abe3-4aea-a316-6a821997442c/83345735929.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9376bf2e-0a04-459c-a9db-2ef521564d62/komufexozuviluwemo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9ae9bf3f-d73d-4caf-9c41-4483f1f7d355/when_will_final_fantasy_7_remake_come_out_on_xbox_one.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b59ceb2e-1be0-4666-8074-7b3f3a7794f7/make_your_own_kitchen_nook.pdfIn PDF document text
  • https://d5cf7a15-73c9-49c9-ad57-d4f0303abb0c.filesusr.com/ugd/0d002d_96a172eb23cf42a7815e3778f896f219.pdf?index=trueIn PDF document text
  • https://97783159-ced7-426e-9fbd-60d2bb3342fb.filesusr.com/ugd/00058f_ed669152bdb14b6cae71e9631d9ada69.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/dd996867-bac5-492a-95d5-b34ef41f0fe0/vimixutexivirowemevodowed.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bcde277f-481d-427a-838c-1b76d6cd5b0d/mazajoruwobakex.pdfIn PDF document text
  • https://d787a32c-196b-4e99-9c98-3ae3c28023f9.filesusr.com/ugd/05b469_0b4f0e3af2754412afd09370cbad3c67.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/9e059e30-d7de-4704-823b-9e0220627113/2000_ford_ranger_automatic_transmission_problems.pdfIn PDF document text
  • https://6b54b0b2-91db-43cc-88c8-bbc4f7e20b37.filesusr.com/ugd/a773aa_e8db1c40e06f420dafd289d407620ce6.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.