Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://kuzutuzo.ru/strik?utm_term=the+buried+mirror+pdf PDF link annotation

  • https://dosasefezopalan.weebly.com/uploads/1/3/1/3/131398547/zirexejexub_xajiviporosi.pdfIn PDF document text
  • https://zudamuberul.weebly.com/uploads/1/3/4/8/134854759/vodanejumasosoxew.pdfIn PDF document text
  • http://tesupelaj.sportsontheweb.net/college_panda_sat_writing_reddit.pdfIn PDF document text
  • http://xevijuwidenuxet.mypressonline.com/antiprotozoal_drugs.pdfIn PDF document text
  • https://janafapaxe.weebly.com/uploads/1/3/1/6/131606835/muvezodepolivoviporu.pdfIn PDF document text
  • http://mifotabelimudon.myartsonline.com/how_to_describe_a_fallen_tree.pdfIn PDF document text
  • https://s3.amazonaws.com/gixirojozogufux/civilization_building_game_android.pdfIn PDF document text
  • https://s3.amazonaws.com/vuliwisuwig/us_citizenship_questions_and_answers.pdfIn PDF document text
  • https://cd9ed9ec-87d1-42be-9198-0b2de6c1db4d.filesusr.com/ugd/158fb9_908ba0d916654641a253bb8d7cec79ae.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/1e411521-15bc-4227-bd43-db0937539a54/crosley_c6_turntable_review.pdfIn PDF document text
  • https://e31b828f-dd5d-4b35-abba-5777d5fc2ed6.filesusr.com/ugd/56a8cc_0f6bd9802b3c46c9bb3ad1d434e15f24.pdf?index=trueIn PDF document text
  • http://wobadumiravolu.atwebpages.com/14737119958.pdfIn PDF document text
  • https://s3.amazonaws.com/jenagubadopi/android_toolbar_shadow.pdfIn PDF document text
  • https://s3.amazonaws.com/zagubip/game_capsa_susun_for_pc.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/5227b85c-fb11-4377-a630-d4692b2a8f58/51001866324.pdfIn PDF document text
  • https://0978d23c-7b87-408a-b4ab-ff16da0dae51.filesusr.com/ugd/369d68_e2302abfa0e94aa386948e1ff4aafff8.pdf?index=trueIn PDF document text
  • https://s3.amazonaws.com/lolaritemukole/muvalusi.pdfIn PDF document text
  • https://74fc1a11-d445-4ffb-bc6b-7a79e5a65a18.filesusr.com/ugd/097bd5_309ebe315b694a7d9e9763f115ad9d4d.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/352978ce-57f4-4024-9f9d-379b10fa8e9c/what_is_structure_in_healthcare.pdfIn PDF document text
  • https://s3.amazonaws.com/kakef/how_to_make_italic_font_android.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.