Malicious PDF — malware analysis report

Heuristics 4

• ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://daxovazevo.weebly.com/uploads/1/3/0/3/130323803/2750021.pdf In PDF document text

  • https://nimufuxiwoz.weebly.com/uploads/1/3/0/4/130483592/barenexolukasiv-bobozew-jezojoziru-povulupegeb.pdfIn PDF document text
  • https://weliwonilubo.weebly.com/uploads/1/3/0/3/130323156/0b3b3e.pdfIn PDF document text
  • https://vuwixagonuri.weebly.com/uploads/1/3/0/3/130313186/joporibozakimipemu.pdfIn PDF document text
  • https://doxinavom.weebly.com/uploads/1/3/0/2/130273803/lubirixep.pdfIn PDF document text
  • https://pomuvefizoza.weebly.com/uploads/1/3/0/4/130492127/7379a904e8426.pdfIn PDF document text
  • https://karijufube.weebly.com/uploads/1/3/0/4/130476079/jakebexevodamapane.pdfIn PDF document text
  • https://zonedajuto.weebly.com/uploads/1/3/0/2/130289577/jewadosejokuxu.pdfIn PDF document text
  • https://ruzebemomubil.weebly.com/uploads/1/3/0/4/130488252/b3969d87f113e8.pdfIn PDF document text
  • https://gujixofijujak.weebly.com/uploads/1/3/0/3/130313595/6114083.pdfIn PDF document text
  • https://gasunefifij.weebly.com/uploads/1/3/0/4/130476671/2417743.pdfIn PDF document text
  • https://tajovabobusetov.weebly.com/uploads/1/3/0/2/130272233/e13d85.pdfIn PDF document text
  • https://levuwiwojilum.weebly.com/uploads/1/3/0/4/130488357/4733608.pdfIn PDF document text
  • https://zoxoriwekotij.weebly.com/uploads/1/3/0/3/130313468/1554473.pdfIn PDF document text
  • https://vifofebexabaze.weebly.com/uploads/1/3/0/4/130435895/eae0a07f3ff.pdfIn PDF document text
  • https://giwefekewid.weebly.com/uploads/1/3/0/2/130270991/4c28912ddac63f.pdfIn PDF document text
  • https://demodafi.weebly.com/uploads/1/3/0/2/130288523/binudarisobi.pdfIn PDF document text
  • https://zojisisegabof.weebly.com/uploads/1/3/0/2/130288381/dezavikilugofako.pdfIn PDF document text
  • https://wefexatipenikeb.weebly.com/uploads/1/3/0/3/130313433/9f88fe20c9ab.pdfIn PDF document text
  • https://rivimotimufezo.weebly.com/uploads/1/3/0/2/130289453/1146142.pdfIn PDF document text
  • https://biresorapesomej.weebly.com/uploads/1/3/0/4/130489240/7361038.pdfIn PDF document text
  • https://fapufopeloda.weebly.com/uploads/1/3/0/2/130289675/130289675.html#adverbial+phrases+year+3+worksheetIn PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_01_sfnt_off0000549f.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_01_sfnt_off0000549f.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.