Malicious PDF — malware analysis report

Heuristics 4

• ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://oakridgefootballbooster.com/uploads/1/3/0/6/130604919/zebasesopu.pdf In PDF document text

  • http://suzanneensmann.com/uploads/1/3/0/4/130478106/miroxolodojeto.pdfIn PDF document text
  • http://refugedajourney.com/uploads/1/3/0/6/130621603/7611276.pdfIn PDF document text
  • https://petufadede.weebly.com/uploads/1/3/0/3/130313429/talam.pdfIn PDF document text
  • http://natgastrucks.com/uploads/1/3/0/5/130542781/9873861.pdfIn PDF document text
  • https://sawemabigiwem.weebly.com/uploads/1/3/0/5/130589270/nuxipozajakadafagi.pdfIn PDF document text
  • http://celiasbakery.com/uploads/1/3/0/3/130313044/2901036.pdfIn PDF document text
  • http://familiarizarse.info/uploads/2020/01/27/dovibifera_xogiteb.pdfIn PDF document text
  • http://vegetariantravel.com/uploads/1/3/0/3/130313336/vovoxo.pdfIn PDF document text
  • http://kupitonline.info/uploads/2020/01/27/b284ad2e44a.pdfIn PDF document text
  • http://podarysam.ru/uploads/2020/01/28/8754506.pdfIn PDF document text
  • http://carlocornelli.com/uploads/1/3/0/6/130621677/cc3a70c0de2e.pdfIn PDF document text
  • http://mudtires.ca/uploads/1/3/0/6/130605269/130605269.html#eclipse+luna++linux+64+bitIn PDF document text
  • http://www.adobe.com/).NotoIn extracted file (font_01_sfnt_off00005a82.bin)
  • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn extracted file (font_01_sfnt_off00005a82.bin)
  • http://scripts.sil.org/OFLNotoIn extracted file (font_01_sfnt_off00005a82.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.