Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://baarspo.ru/award?keyword=amoxicilina+bd+bula+pdf PDF link annotation

  • http://rgtuitp.ru/accu-chek_compact_plus_test_strips_51_eachmm0g9.pdfIn PDF document text
  • http://securityverifiedservices.com/bolelixigdtqxu.pdfIn PDF document text
  • https://muwozijazi.weebly.com/uploads/1/3/4/7/134736858/2773649d7c7a1.pdfIn PDF document text
  • http://dirujadejefogax.iblogger.org/rorodugatojenibinob.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4485014/normal_5ff3112f8ead0.pdfIn PDF document text
  • http://osmosiotzs.fun/hungry_shark_evolution_dinheiro_infinito_apkw0wwv.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4413563/normal_5ff8939ca5eab.pdfIn PDF document text
  • https://cdn.sqhk.co/rijomawonuj/igje9jg/download_we_heart_it_premium.pdfIn PDF document text
  • https://lorerepurukese.weebly.com/uploads/1/3/1/4/131453396/9bd4c9ae8064.pdfIn PDF document text
  • https://cdn.sqhk.co/dikapagoloza/Phd2Wtu/90607397091.pdfIn PDF document text
  • http://new-volosi.ru/60055112141q6zxg.pdfIn PDF document text
  • https://cdn.sqhk.co/zafowavo/2KEjhsd/79007266129.pdfIn PDF document text
  • http://axecheat5.xyz/blackberry_link_software_for_pcn76i4.pdfIn PDF document text
  • https://bojomuse.weebly.com/uploads/1/3/4/4/134462584/8000173.pdfIn PDF document text
  • https://cdn.sqhk.co/ginijetemepa/ibUjcge/mujonixowezaxu.pdfIn PDF document text
  • http://xemajerekagow.epizy.com/balance_sheet_explained.pdfIn PDF document text
  • https://ca3ec1ac-6ff7-4c8f-ae0f-86a30d86e335.filesusr.com/ugd/3615fb_6e9a31506d5a40e3996291a44e27a9ab.pdf?index=trueIn PDF document text
  • https://7be8961d-effb-4c78-a255-78c3c9f0be09.filesusr.com/ugd/3dd68e_34215f4aa6d64512a5aea257bef8566b.pdf?index=trueIn PDF document text
  • https://72a23b54-95c1-47c0-80d6-f7b1310faeb8.filesusr.com/ugd/65b209_c72d4b306c4c40fd884fc400d05c792c.pdf?index=trueIn PDF document text
  • https://a2876ee3-c470-454a-91e2-e108d831033a.filesusr.com/ugd/e8dba5_ed085de871bc4ff49ad8aff46b08145e.pdf?index=trueIn PDF document text
  • https://1c684d3d-b1aa-4d58-8f8e-408f9cf37fac.filesusr.com/ugd/64d889_ad4d9293d9f744dc90f0d31e4fed78c1.pdf?index=trueIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.