Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://queure.ru/pbw?utm_term=real+car+parking+2+hack+2020 PDF link annotation

  • https://xoxomedeze.weebly.com/uploads/1/3/5/3/135308121/nadisurunelusumof.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4489255/normal_5ff45a0f84481.pdfIn PDF document text
  • https://joxobupapi.weebly.com/uploads/1/3/1/4/131454586/dogojaxelu.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4474457/normal_5ff3c1592fb72.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4489412/normal_6043dee5a4e4b.pdfIn PDF document text
  • https://xuvunigito.weebly.com/uploads/1/3/1/1/131164310/gezezobafetomijo.pdfIn PDF document text
  • https://romubavopu.weebly.com/uploads/1/3/4/8/134884942/timibakinedu-bamika.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/63592d65-3a7f-407f-88a6-58d3865b5d46/85843907490.pdfIn PDF document text
  • http://sozakuvepar.pbworks.com/f/boseg.pdfIn PDF document text
  • http://taxexuwej.pbworks.com/f/parallel_and_perpendicular_lines_worksheet_answer_key_unit_3.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b46b5691-99af-4f4c-884f-ba1364a250b2/kufifodize.pdfIn PDF document text
  • http://bovozajezo.pbworks.com/w/file/fetch/144693204/nadhaswaram_music_mangala_vadyam_nadaswaram_thavil_music_mp3_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/212a5cf7-b374-4c1d-b237-61746a3c4a88/18626151307.pdfIn PDF document text
  • http://suniger.pbworks.com/f/turbulence_training_free_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/fd86da01-1fd7-4fe1-be5a-8378def80139/97096678992.pdfIn PDF document text
  • http://pajinap.pbworks.com/w/file/fetch/144662103/biugo_app_free_download.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2a431998-f80c-438e-8bd5-19a1ae8382f3/what_happens_if_you_refuse_a_pre_employment_drug_test.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/541440b8-8862-4a2a-ab11-6b8676c820ee/7377400687.pdfIn PDF document text
  • http://sowenux.pbworks.com/f/john_deere_240_skid_steer_operators_manual.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/db144ccc-5c2d-4eba-b96a-6b00331f74a9/mexiz.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/81fed527-2a2c-4f7d-a249-a7cf486aa8ae/65588329605.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.