Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Macro/content-enable lure medium SE_ENABLE_LURE
  Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://crophysi.ru/strik?utm_term=happy+endings+season+3+episode+1+cast PDF link annotation

  • http://kojazunupetip.mygamesonline.org/fitalafu.pdfIn PDF document text
  • http://xepelewatelaziv.getenjoyment.net/61196430009.pdfIn PDF document text
  • https://cdn.sqhk.co/romumoxoleno/ciiggLG/luwesedizodurevaguv.pdfIn PDF document text
  • http://zokidinodajives.getenjoyment.net/how_to_set_up_dbx_driverack_px.pdfIn PDF document text
  • https://cdn.sqhk.co/kumotuxijufu/eighhib/nintendo_switch_can_t_find_ip_address.pdfIn PDF document text
  • https://cdn.sqhk.co/sipobufiw/geBjfhh/83632877227.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4489429/normal_5ff0be60c0104.pdfIn PDF document text
  • https://cdn.sqhk.co/retobumoki/ifjehi3/gemavepotanabepufevenapin.pdfIn PDF document text
  • https://cdn.sqhk.co/xumesapaxoku/ria1iep/jegadegomilododadupo.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4449779/normal_5fdc29180be30.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4456667/normal_5ff61d8d999b6.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4495849/normal_601212060d616.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4370528/normal_5fffbbb2ee4fe.pdfIn PDF document text
  • http://jukejed.mypressonline.com/act_punctuation_rules.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://c72a6d71-2fad-4f5a-8b7a-a7c165485bce.filesusr.com/ugd/a4966f_72bd36a2337c4fb890dc0cc50fc8b603.pdf?index=trueIn PDF document text
  • https://96a9e3af-f0c3-4048-9e6c-0ad8da3c6018.filesusr.com/ugd/15d534_1b9d7c97cdac40b69d70b3e0efb0c1b5.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/a7e38bec-188e-4310-ad2f-238ff4fdcaf6/lg_pad_7.0_hard_reset.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/be0dcdd0-f992-428d-aeed-17856a7eebc9/28951507457.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/bfba89b6-3200-4a16-bac7-c21909e5bcfd/programa_para_honores_ala_bandera_mes_de_enero.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2d6325d3-3722-488c-947a-4ab69e46b2dc/lududulu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/accabdfc-9a1b-4fe9-a7e9-afd88b8a0513/how_to_write_epsilon_on_mac.pdfIn PDF document text
  • https://c78267de-509c-4cb0-9394-6b21b7876e04.filesusr.com/ugd/290ce3_b522363c4e77468fbcc76c2a9eb3436e.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/c11e6926-c3f2-432f-a8a2-b0098b0898ad/fluke_117_vs_179.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/65968660-7c6d-4798-a5ea-eaf5ccedcf28/jexefepe.pdfIn PDF document text
  • https://a50dbba5-e4fd-40cc-afa9-a45495a5accf.filesusr.com/ugd/7f929b_1013c245b90b4f5d861db4d4ba8b20ce.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/d7ea22ca-8dc4-46d3-ba2c-4b15ce73abc7/texas_cdl_handbook_in_spanish.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/db708222-125b-49ad-9fc7-5c7e000fe875/verb_to_do_exercises.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.