Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://yafferge.ru/123?utm_term=manual+food+processor+pampered+chef+recipes In PDF document text

  • http://bluebadgeapproval.com/lovibkaccu.pdfIn PDF document text
  • https://noxerurivago.weebly.com/uploads/1/3/4/7/134767941/f6503343f4752d.pdfIn PDF document text
  • http://about-central.com/jazizukodewu05slu.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4405687/normal_600b2e97a0ee9.pdfIn PDF document text
  • http://electriccannoz.club/daselalitomerosumegugofap1oae.pdfIn PDF document text
  • https://zobojosapez.weebly.com/uploads/1/3/1/4/131483592/vesiwope-pafedomafosu-fubobilaxenabi.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4369912/normal_5ff7704430130.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4381294/normal_5fd191505717a.pdfIn PDF document text
  • https://jonabosaguvaxak.weebly.com/uploads/1/3/4/8/134858844/068c096.pdfIn PDF document text
  • http://ductsunlimitedins.com/61298074344i8hbq.pdfIn PDF document text
  • https://suxegetolikas.weebly.com/uploads/1/3/4/0/134097713/3248630.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4490961/normal_6007b1c8af9d7.pdfIn PDF document text
  • https://mimasalidapu.weebly.com/uploads/1/3/4/4/134466186/357a5c0acf3.pdfIn PDF document text
  • https://s3.amazonaws.com/zuses/billie_eilish_live_performances.pdfIn PDF document text
  • https://s3.amazonaws.com/jowutoneranemuk/tofonegenopepivime.pdfIn PDF document text
  • https://s3.amazonaws.com/zugutixe/python_flask_jinja2_template.pdfIn PDF document text
  • https://s3.amazonaws.com/ninasivol/colors_worksheets.pdfIn PDF document text
  • https://s3.amazonaws.com/zuponefi/hpu_m._a_online_form_2019.pdfIn PDF document text
  • http://gozotonitiki.epizy.com/kawizizarukijukedetumugi.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.