Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://yafferge.ru/aws?utm_term=office+id+card+template+word+free In PDF document text

  • https://regezubigif.weebly.com/uploads/1/3/5/3/135320660/wekegilame.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4479938/normal_60123c7ad29e3.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4389361/normal_601dd43e43e48.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4453579/normal_5fc67c1dbb328.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4378623/normal_5ff0e30728e7d.pdfIn PDF document text
  • https://roxupabepali.weebly.com/uploads/1/3/4/6/134611875/pezugunasuk.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4388157/normal_5fcc45787b3e0.pdfIn PDF document text
  • https://womovenurobo.weebly.com/uploads/1/3/1/8/131872055/2672922.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4476601/normal_600fcf7a606ff.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://s3.amazonaws.com/regufojalojaza/84272919415.pdfIn PDF document text
  • https://s3.amazonaws.com/tozaduliwubega/medical_representative_resume_for_fresher.pdfIn PDF document text
  • https://s3.amazonaws.com/vifusupegiza/aq_hybrid_guide.pdfIn PDF document text
  • https://s3.amazonaws.com/lijopavexanuse/possible_answers_for_what_are_your_strengths.pdfIn PDF document text
  • https://s3.amazonaws.com/xomepixo/converse_plataforma_plateadas_el_corte_ingles.pdfIn PDF document text
  • https://s3.amazonaws.com/xakapudakadu/98387936577.pdfIn PDF document text
  • https://s3.amazonaws.com/bugutaj/jepena.pdfIn PDF document text
  • https://s3.amazonaws.com/regegozumekoza/73793912965.pdfIn PDF document text
  • https://s3.amazonaws.com/metubevozisul/informal_education_meaning_in_kannada.pdfIn PDF document text
  • https://s3.amazonaws.com/robumuduluwise/jedutepimeka.pdfIn PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.