Malicious PDF — malware analysis report

Heuristics 3

• ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://cryptopalz.com/uploads/1/3/0/6/130620367/560965445327e3.pdf In PDF document text

  • http://11pluscolchester.com/uploads/1/3/0/2/130289623/5416356.pdfIn PDF document text
  • http://stayprotected.org/uploads/1/3/0/2/130271159/bapuxadutuw.pdfIn PDF document text
  • http://kalaman.net/uploads/1/3/0/4/130489434/lasilumivob.pdfIn PDF document text
  • http://snmfineart.com/uploads/1/3/0/7/130776776/mulomafirexizonifuta.pdfIn PDF document text
  • http://massinventorymanagement.com/uploads/1/3/0/4/130476513/tudukazego_kotegaxed_kamisowesof.pdfIn PDF document text
  • http://blueabydesigns.com/uploads/1/3/0/7/130775398/lukolepapugedel_vonex_nozepavufe.pdfIn PDF document text
  • http://michigancourses.com/uploads/1/3/0/2/130288644/divar_navonowalekix_pezox.pdfIn PDF document text
  • http://bergersolutions.co/uploads/1/3/0/4/130435635/4038334.pdfIn PDF document text
  • http://splaxcustoms.com/uploads/1/3/0/6/130604281/176599.pdfIn PDF document text
  • http://youthtensils.com/uploads/1/3/0/5/130543293/1431288.pdfIn PDF document text
  • http://naturesowncharcoal.com/uploads/1/3/0/4/130491594/7abcb3b9681f.pdfIn PDF document text
  • http://ashleighvaillancourt-winebrenner.com/uploads/1/3/0/2/130287502/537719.pdfIn PDF document text
  • http://lovemugshop.com/uploads/1/3/0/5/130538902/a483a63a1.pdfIn PDF document text
  • http://mykpilgrim.com/uploads/1/3/0/7/130739856/869ed.pdfIn PDF document text
  • http://tia.media/uploads/1/3/0/6/130604185/merelikifeleme-zimidibedi.pdfIn PDF document text
  • http://artbyjulieh.com/uploads/1/3/0/7/130740163/145290.pdfIn PDF document text
  • http://sharedtravel.voyagerwebsites.com/uploads/1/3/0/2/130272250/1bec9a481d83c.pdfIn PDF document text
  • http://moirarogers.net/uploads/1/3/0/7/130776042/nikubanujezoguzodam.pdfIn PDF document text
  • http://co-opsourced.com/uploads/1/3/0/2/130287266/2050252.pdfIn PDF document text
  • http://amicoffeecompany.com/uploads/1/3/0/5/130545666/130545666.html#adobe+premiere+cs4+portable+32+bits+megaIn PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000033e9.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off000033e9.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.