Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jacksth.ru/strik?utm_term=how+long+does+a+hyperbaric+oxygen+treatment+last PDF link annotation

  • http://powuvomewekuxeb.getenjoyment.net/ways_to_ensure_validity_and_reliability_in_research.pdfIn PDF document text
  • http://sajiwurejedetu.sportsontheweb.net/52838786549.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.daltonmaag.com/In PDF document text
  • https://29c5b005-6627-40e3-9da1-9f9d3dbc34dc.filesusr.com/ugd/7ad284_80b70bf97a0d4994b4a2c3b7986fed02.pdf?index=trueIn PDF document text
  • http://joxepivebafugig.epizy.com/76625574659.pdfIn PDF document text
  • http://gofumakexoj.onlinewebshop.net/download_adobe_acrobat_reader_for_pc.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9c324bcc-bea3-4593-941c-e1be3556d5ad/skin_burning_sensation_on_lower_legs.pdfIn PDF document text
  • https://ad843f61-c544-48d7-8cfb-3c048b9edb46.filesusr.com/ugd/0dd9ed_1c2cf29c54164303a316b8147c351c80.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/8d05bde0-d6f3-424e-ba2d-c11d5124c52d/cul_es_la_fruta_que_tiene_ms_protenas.pdfIn PDF document text
  • http://getojigukas.epizy.com/nunowiwibivowesotamimago.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2ca20895-08e7-4c56-9179-a43bc9c8c0b6/4172376856.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9327c877-be81-4e8e-a7de-278e51b97a63/31206940499.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c112ab4f-49b4-443d-ab33-ef3daa59b0e5/what_seasoning_is_on_taco_bell_nacho_fries.pdfIn PDF document text
  • https://f06ae689-34e6-4fd9-b749-a5985747e370.filesusr.com/ugd/4117a9_8c105a36494c42f5b062113270c1543b.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/490f5ad9-1bd1-4af0-b608-963696eada69/59776313396.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/651973b3-c0da-433f-a439-24197528e192/duxuwovefi.pdfIn PDF document text
  • https://s3.amazonaws.com/muvazi/pokolulubugojekeja.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dd0ecaea-7ed7-4e2a-b2f3-ed8a615ae007/rodogofa.pdfIn PDF document text
  • https://9c33b4df-6f14-41ad-9e94-a3a23f7ed20d.filesusr.com/ugd/2a975f_a2316e5367b44c7dbdfd03ed815be3de.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/08d7b114-3c83-4f80-b17b-20e837758606/61794038991.pdfIn PDF document text
  • http://firiwigisu.atwebpages.com/when_were_prisons_invented_in_america.pdfIn PDF document text
  • https://ff4d9611-e7ea-45f2-85d3-f0b464ef817f.filesusr.com/ugd/48f461_8a32c798604c4428bd3d39d6dde64c52.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/cbe1daf0-1194-43ff-b1e3-98ba6fa155b6/wendys_fries_nutrition_label.pdfIn PDF document text
  • https://s3.amazonaws.com/xurixado/aparichit_movie_mp4_free.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.