Malicious PDF — malware analysis report

Heuristics 4

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jottigo.ru/aws?utm_term=son+lois+lowry PDF link annotation

  • http://duwinijuj.mypressonline.com/65180295729.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4383679/normal_602c20c3eba46.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4375886/normal_601928479fb96.pdfIn PDF document text
  • http://mowukedova.mypressonline.com/zinijixasemuzukojowidifor.pdfIn PDF document text
  • http://zagejudivavi.sportsontheweb.net/crusader_kings_2_cheats_claim_empire.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366639/normal_60307826cc016.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4393790/normal_5fcd5e6a33d9b.pdfIn PDF document text
  • http://guburifesujera.22web.org/starfrit_mightican_manual_can_opener.pdfIn PDF document text
  • http://xumukekuvag.22web.org/cloud_computing_for_big_data_salary_in_canada.pdfIn PDF document text
  • http://munasimowijuxi.getenjoyment.net/zorejasobasujikex.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4385876/normal_5fd10ee952026.pdfIn PDF document text
  • http://nafigunagofadab.getenjoyment.net/business_model_generation_espaol_gratis.pdfIn PDF document text
  • http://tekelas.iblogger.org/lesejetizaxubime.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/3f6ae328-0ff1-4c3b-b7d6-269bbe8a4a3c/gogavol.pdfIn PDF document text
  • https://6a1e2a5f-c456-4288-b9d5-5378f87870fb.filesusr.com/ugd/076fac_03393ce7056a4c9e9d21eeb815df68c7.pdf?index=trueIn PDF document text
  • https://f5071db7-799c-4807-8cfa-c66b012f33b1.filesusr.com/ugd/9a4546_8fede7fb7126403181598f5bbdf59efa.pdf?index=trueIn PDF document text
  • http://rujolur.rf.gd/guitar_neck_jig_template.pdfIn PDF document text
  • https://7a512b58-7189-4bc4-8343-f643fa9054c9.filesusr.com/ugd/1e52da_146bf286842944119f52c2233ea1fc6f.pdf?index=trueIn PDF document text
  • https://3c4962d9-41f7-4f14-8396-dad57cc8de20.filesusr.com/ugd/a2de88_3ccdce3b6e3f48c18ac19b395f898a3c.pdf?index=trueIn PDF document text
  • http://bagibuboje.rf.gd/sibitavivepagawonesamobu.pdfIn PDF document text
  • https://71e5fc8e-cc9a-4633-96c3-2c70acd464d0.filesusr.com/ugd/f08e01_fb22786ad03a4c268b3ff87588dd18fb.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/f24f4388-318f-4d25-8a14-b01280acf2aa/lord_of_the_rings_beren_and_luthien_movie.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b4483f0b-221c-48c1-93f6-766d96596001/how_to_find_proofreading_work.pdfIn PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.