Malicious PDF — malware analysis report

Heuristics 3

• ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://zawufi.atimer.net/uploads/2020/01/27/159425.pdf In PDF document text

  • http://dom63.su/uploads/2020/01/27/lumedelowugo.pdfIn PDF document text
  • https://rapiviwobefedes.weebly.com/uploads/1/3/0/4/130435544/bipajiva.pdfIn PDF document text
  • http://beyondjordanarise.com/uploads/1/3/0/6/130603873/levexakita.pdfIn PDF document text
  • http://set.bc-sd.online/uploads/2020/01/28/01ad7ac9.pdfIn PDF document text
  • http://min.mailsens01.online/uploads/2020/01/28/0cd2479cb.pdfIn PDF document text
  • http://lurote.samba-careers.online/uploads/2020/01/29/d36fac4e43783c.pdfIn PDF document text
  • http://gav.epay-clientesv3-0range.com/uploads/2020/01/28/vuber_vivup_narikolokiw_mepevezarowag.pdfIn PDF document text
  • http://envirotw.com/uploads/1/3/0/4/130477890/130477890.html#fairy+tail+100+year+quest+mangaIn PDF document text
  • http://www.adobe.com/).NotoIn extracted file (font_01_sfnt_off00004f7e.bin)
  • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn extracted file (font_01_sfnt_off00004f7e.bin)
  • http://scripts.sil.org/OFLNotoIn extracted file (font_01_sfnt_off00004f7e.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.