Malicious PDF — malware analysis report

Heuristics 3

• ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://panutawer.weebly.com/uploads/1/3/0/4/130483660/f511f3f.pdf In PDF document text

  • http://rainbowsprinklescupcakery.com/uploads/1/3/0/6/130621597/sixeziloda.pdfIn PDF document text
  • http://xete.dream-boxxx.ru/uploads/2020/01/27/tofiguxawakitef.pdfIn PDF document text
  • http://mylittletruffles.com/uploads/1/3/0/4/130483836/kudavoxobosawimomuxa.pdfIn PDF document text
  • https://rasukibo.weebly.com/uploads/1/3/0/5/130588692/b22ff41eeff681.pdfIn PDF document text
  • http://kypit-zeroslim.ru/uploads/2020/01/28/jenodamasataratogum.pdfIn PDF document text
  • http://fixa.sakp.tech/uploads/2020/01/29/6600234.pdfIn PDF document text
  • http://alphamediaagency.com/uploads/1/3/0/4/130483848/a4895e8ce.pdfIn PDF document text
  • http://molelos.betdouble.ru/uploads/2020/01/28/9612d878.pdfIn PDF document text
  • http://bayadapediadtricswlm.com/uploads/1/3/0/6/130604233/4625376.pdfIn PDF document text
  • http://art4peace.net/uploads/1/3/0/5/130550890/wipixivutomisufeg.pdfIn PDF document text
  • http://mtbakercrossfit.com/uploads/1/3/0/4/130477363/3902557.pdfIn PDF document text
  • http://mydne.com/uploads/1/3/0/5/130588237/kefulesidaguzefu.pdfIn PDF document text
  • http://musclesandmimosas.us/uploads/1/3/0/5/130544147/rilusumimikavu.pdfIn PDF document text
  • http://365poolspa.com/uploads/1/3/0/6/130604950/jovakepiwona.pdfIn PDF document text
  • http://nakomahomesandland.com/uploads/1/3/0/4/130435596/81de46316.pdfIn PDF document text
  • http://tmpropertysolutions.com/uploads/1/3/0/2/130287896/7506876.pdfIn PDF document text
  • http://nabhthefam.com/uploads/1/3/0/5/130550982/mukawilusoxav.pdfIn PDF document text
  • http://korixa.winpoker.org/uploads/2020/01/29/3740849.pdfIn PDF document text
  • http://canterburynorthwestern.org/uploads/1/3/0/3/130323422/23bd62ea1f29.pdfIn PDF document text
  • http://gppasco.com/uploads/1/3/0/4/130489222/vadovize_lomajevezop_niduzek_wigidagimulejik.pdfIn PDF document text
  • http://newkids.co.uk/uploads/1/3/0/5/130550663/130550663.html#be+with+you+korean+movieIn PDF document text
  • http://www.adobe.com/).NotoIn extracted file (font_01_sfnt_off00006aaa.bin)
  • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn extracted file (font_01_sfnt_off00006aaa.bin)
  • http://scripts.sil.org/OFLNotoIn extracted file (font_01_sfnt_off00006aaa.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.