Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://seumenha.ru/award?keyword=bihar+police+sub+inspector+previous+year+question+paper+pdf PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4418365/normal_60310e81e7ecd.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4368222/normal_600fb70e7f6d2.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4449402/normal_5fee1fed2ed90.pdfIn PDF document text
  • https://cdn.sqhk.co/sepetoxofaw/geHjd28/nicki_minaj_height_ft.pdfIn PDF document text
  • https://mufewikusa.weebly.com/uploads/1/3/4/0/134042586/jugufujewegopapi.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4494165/normal_6031603b9fb32.pdfIn PDF document text
  • https://cdn.sqhk.co/sopiloroda/WrsqieC/tuberculosis_test_near_me.pdfIn PDF document text
  • https://cdn.sqhk.co/bujerinalo/hajdk4X/33672199809.pdfIn PDF document text
  • https://bibomezu.weebly.com/uploads/1/3/2/7/132710601/8353470.pdfIn PDF document text
  • https://nosozekime.weebly.com/uploads/1/3/4/6/134634018/4681451.pdfIn PDF document text
  • https://cdn.sqhk.co/birenejar/jejag4Q/99442417272.pdfIn PDF document text
  • https://cdn.sqhk.co/jarogofef/VlEjjgi/sojazukareresafepuvo.pdfIn PDF document text
  • https://cdn.sqhk.co/viwedanej/aIiihcv/pigaje.pdfIn PDF document text
  • https://cdn.sqhk.co/kubepugemaki/Ejjha0c/home_defense_shotgun_sportsman_s_warehouse.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/ff374e4a-5565-4295-b335-44017d3ada29/98750180188.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/c70a4787-ef7e-45de-97fe-04cad4bbb930/repeated_addition_worksheets_for_3rd_grade.pdfIn PDF document text
  • https://49b7c339-fea6-4bb3-bf7b-ca47af5263df.filesusr.com/ugd/6ca12d_0180082bd996440984259de729f9ce3a.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/46ecb428-eb34-4711-a26e-1649acbc65c5/muwetedifilewulusevabuka.pdfIn PDF document text
  • https://068ba8bc-08b0-4b68-8151-f3c59c7a5775.filesusr.com/ugd/5a4aad_55109f9159af4dc19cb2ae86c8f6f490.pdf?index=trueIn PDF document text
  • https://8271b8e8-1520-4b18-8785-2fafc8cd33e6.filesusr.com/ugd/efc97f_16f5326acd72420bb4f8bb96cc69c443.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/728acea2-12d4-421a-86a8-00e4e0bd2f60/how_to_use_humidifier_for_plants.pdfIn PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.