Malicious PDF — malware analysis report

Heuristics 5

• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://irlanc.ru/pbw?utm_term=what+do+you+do+when+snapchat+says+suspicious+login

  • https://dalideno.weebly.com/uploads/1/3/5/3/135384103/fakeb_legular_vusegokuwifugo.pdf
  • https://static.s123-cdn-static.com/uploads/4443292/normal_5fccd1002c70c.pdf
  • https://savozajit.weebly.com/uploads/1/3/5/3/135320594/64dd5796.pdf
  • https://cdn-cms.f-static.net/uploads/4381551/normal_60383567834f6.pdf
  • https://pituzidadago.weebly.com/uploads/1/3/4/7/134722752/585a86b2c.pdf
  • https://sifoginugiji.weebly.com/uploads/1/3/4/5/134588619/kijiwod-bojaxorikena.pdf
  • https://cdn-cms.f-static.net/uploads/4413585/normal_60571cad6bca9.pdf
  • https://kirorasonosa.weebly.com/uploads/1/3/4/7/134743937/be2fabf68f.pdf
  • https://zoxogonufi.weebly.com/uploads/1/3/4/9/134900606/xubekeval.pdf
  • https://jasevumoxemu.weebly.com/uploads/1/3/4/7/134707335/zinarudoxufa.pdf
  • https://totupima.weebly.com/uploads/1/3/1/4/131438580/2203982.pdf
  • https://dizakevusarebiz.weebly.com/uploads/1/3/4/5/134581037/df625cac0159.pdf
  • https://cdn-cms.f-static.net/uploads/4448126/normal_600fe395c8516.pdf
  • https://xodinelexobi.weebly.com/uploads/1/3/1/4/131438891/2549709.pdf
  • https://cdn-cms.f-static.net/uploads/4403680/normal_6012884344b01.pdf
  • https://sawolopu.weebly.com/uploads/1/3/6/0/136049845/1bfa242f8fc48b.pdf
  • https://muluxebaxomoj.weebly.com/uploads/1/3/5/4/135401331/8ed5d7569f.pdf
  • http://www.ascendercorp.com/
  • http://www.ascendercorp.com/typedesigners.html
  • https://uploads.strikinglycdn.com/files/ea0f29b7-00ee-4036-8a96-da3091dacafe/what_is_fcc_in_finance.pdf
  • http://wigiwopajuke.pbworks.com/f/coin_master_mod_apk_giros_infinito_2021.pdf
  • https://uploads.strikinglycdn.com/files/e4733a4e-6ccf-413c-9652-f6e834081a19/how_to_calculate_irr_when_npv_is_zero.pdf
  • http://nidibewuzi.pbworks.com/f/how_to_fix_your_tassimo_machine.pdf
  • http://pezeliv.pbworks.com/w/file/fetch/144417537/download_bluetooth_for_pc_windows_7_filehippo.pdf
  • https://uploads.strikinglycdn.com/files/ecf87b0c-7f61-439b-a373-3873b1279c5b/trane_air_conditioner_outside_fan_not_working.pdf
  • http://bilabegape.pbworks.com/w/file/fetch/144631716/82973591658.pdf
  • http://tijigika.pbworks.com/f/ged_math_study_guide_2021.pdf
  • https://uploads.strikinglycdn.com/files/e4c5e5c6-e30c-45cf-a143-1e6114474316/abraham_lincolns_plan_for_reconstruction.pdf
  • http://scripts.sil.org/OFL

Open this report in the interactive analyzer, or submit your own file for analysis.