Malicious PDF — malware analysis report

Heuristics 4

• ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://mywhiteengineering.com/uploads/1/3/0/4/130435820/goletekatag.pdf In PDF document text

  • http://mystudio500-woodfiredpottery.com/uploads/1/3/0/5/130551341/7502132.pdfIn PDF document text
  • http://branchlutheranschoolshaiti.net/uploads/1/3/0/5/130551258/xatebixowi.pdfIn PDF document text
  • http://bourioanatoliesfilms.net/uploads/1/3/0/7/130740045/6724710.pdfIn PDF document text
  • http://doublehranch.ca/uploads/1/3/0/4/130489958/nirevisubexidule.pdfIn PDF document text
  • http://message6666.com/uploads/1/3/0/6/130639655/9682024.pdfIn PDF document text
  • http://neubacher.vafercapital.com/uploads/1/3/0/4/130477152/130477152.html#data+analysis+examples+pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.