Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://kuzutuzo.ru/strik?utm_term=index+imperium+1 PDF link annotation

  • http://tixaman.scienceontheweb.net/hernia_umbilikalis_adalah.pdfIn PDF document text
  • http://tuzirawejaw.mypressonline.com/advanced_language_practice.pdfIn PDF document text
  • http://mogimetekojubar.scienceontheweb.net/words_to_use_instead_of_responsible_on_resume.pdfIn PDF document text
  • https://cdn.sqhk.co/rosivapixove/gXCOzH0/sticker_maker_video_apk.pdfIn PDF document text
  • https://cdn.sqhk.co/gorubabor/dh5heid/modern_zig_zag_wallpaper_pink.pdfIn PDF document text
  • https://cdn.sqhk.co/bexefoboxevi/gigk50A/winking_lizard_tavern_near_me.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://aa4c2489-c93b-4667-afab-104bf5323bad.filesusr.com/ugd/8b49c6_2fff83da83ae4cc08a2a159d30d8c895.pdf?index=trueIn PDF document text
  • https://d1897088-ef6e-4b60-8303-910b4b551fc1.filesusr.com/ugd/4cfbbd_d6c8be9e8a7846e6865b37147eea2b85.pdf?index=trueIn PDF document text
  • https://44f39d5c-a655-4437-91b6-62b11e148e71.filesusr.com/ugd/eb4c03_4363276c208941cfa51ffa41a3cc245c.pdf?index=trueIn PDF document text
  • https://caf0f927-206f-4b4e-aa34-0dd3da53679b.filesusr.com/ugd/83d902_289b362a8270414d88295b6a4be503b3.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/d48b2e86-086f-44c9-95ee-8864219a031a/how_to_start_a_new_track_in_audacity.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7e769b2e-fed3-4795-adf0-e17f001da3be/how_to_reset_remote_control_for_spectrum.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2fa719be-39bc-4871-89a8-555ed39d6686/tapatabefonatebobukuveri.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/85fa19da-a848-4bda-ade3-55fdb74b2d1c/jackie_chan_around_the_world_in_80_days_full_movie.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/47c8f374-636f-4764-916c-4d8f8924a8b6/29861672787.pdfIn PDF document text
  • https://959e49da-b405-4961-97d4-5c1bb2e9a628.filesusr.com/ugd/ab0441_d5118d8d94a24d0ab8327a8eff2bb89d.pdf?index=trueIn PDF document text
  • https://1d942ef5-affb-47d8-8f99-70a3d187b733.filesusr.com/ugd/3283b0_93b835dc8c8b497db50493e317961483.pdf?index=trueIn PDF document text
  • https://238a82c5-85a8-4641-a991-2f0f5270ddc4.filesusr.com/ugd/63f22d_9f33cb80fede4b9dbe142460a0d8edc6.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/5ed8ea2f-5017-4cdb-8874-75b84775e924/how_fast_does_a_roller_coaster_go.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.