Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://fokemale.ru/strik?utm_term=gone+with+the+wind+quotes+imdb PDF link annotation

  • https://xaberekulokoka.weebly.com/uploads/1/3/1/8/131856377/7444208.pdfIn PDF document text
  • http://sdfafq.info/kinozawabigeovd2m.pdfIn PDF document text
  • http://mebelintera.ru/zasewewezuzuwikavovuzanix98hup.pdfIn PDF document text
  • http://tramlaweq.online/john_deere_190c_steering_gearjqpbz.pdfIn PDF document text
  • http://magnetfix.store/netgear_n600_c3700_spectrumrmp11.pdfIn PDF document text
  • http://lojasamericanasbr.com/how_to_replace_belt_on_kenmore_dryer_70_series27kz1.pdfIn PDF document text
  • http://thedefenseforge.com/ulala_idle_adventure_tank_guidewjw5i.pdfIn PDF document text
  • http://peuly.xyz/77131430942r7gr9.pdfIn PDF document text
  • https://jitugexe.weebly.com/uploads/1/3/0/9/130969989/8415038.pdfIn PDF document text
  • http://doorstepcomputers.com/525897727788ul0w.pdfIn PDF document text
  • https://vudulami.weebly.com/uploads/1/3/5/9/135964857/7d9de394ae.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/f7c2c255-a362-4a30-ad5d-617b94996855/conocimiento_cientfico_metodologia_dela_investigacion.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f39e863d-f6fc-44a5-8df8-a24c0067a0a7/naxefimajobojefesu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8bf05558-7bfc-4f3e-9d9b-4ec0afd5cba7/mosap.pdfIn PDF document text
  • https://s3.amazonaws.com/tometubufimopim/fomosovavogumatajumutib.pdfIn PDF document text
  • https://s3.amazonaws.com/limepusotanal/macromedia_freehand_10_software_free.pdfIn PDF document text
  • https://s3.amazonaws.com/sinamozagemoger/chattakkari_2012_songs.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ea0377f3-7ec7-4e02-bd38-6a6a8dadde47/badger_5xp_manual.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/736f205c-0324-45ea-b629-042666c405a7/17268327853.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/faa49e70-267f-4af5-9a8e-a4bf53ef1015/fididixigolukekeseg.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7df7c028-389c-45ff-8843-977ad99bce4b/arris_tm722g_specs.pdfIn PDF document text
  • https://s3.amazonaws.com/dukexajuj/53238085121.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/93cb7205-fe59-4205-844f-d3f7a86f0f91/how_to_crack_minecraft_windows_10_edition_free_trial.pdfIn PDF document text
  • https://s3.amazonaws.com/fajixe/how_old_is_the_antagonist_in_thank_you_maam.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d27a3716-3889-4907-9d4b-656c9fe33d4f/75562847597.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9c6cb227-e620-4155-b5d8-9043fcbe6b6d/what_is_a_cmyk_code.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.