Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jacksth.ru/strik?utm_term=biblia+original+hebrea+traducida+espa%25C3%25B1ol PDF link annotation

  • https://wadaletabuj.weebly.com/uploads/1/3/2/6/132695896/8cd72dcbffae5.pdfIn PDF document text
  • https://povarudoro.weebly.com/uploads/1/3/5/3/135324530/nabovura_bokoxo_zedigemolu.pdfIn PDF document text
  • http://tuguxanofa.iblogger.org/wejutifekezetukiwotuvo.pdfIn PDF document text
  • http://supozupewurak.22web.org/arelle_gaming_apk.pdfIn PDF document text
  • https://kosazalosir.weebly.com/uploads/1/3/2/8/132815054/1272573.pdfIn PDF document text
  • https://s3.amazonaws.com/fosalizuzu/18334772679.pdfIn PDF document text
  • https://s3.amazonaws.com/fekazudabo/76540240460.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/d367962b-9cf5-4f10-bc55-6301eada186b/why_was_the_decision_in_brown_vs_board_of_education_so_broadly_significant.pdfIn PDF document text
  • https://s3.amazonaws.com/niwotipugonuvoz/kunonanirab.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/24f4e4a9-c7a7-459d-a4a1-18c20aa78478/konabetizerulaxipelem.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9a128278-d695-47fc-8d7d-911056fa1467/27052911137.pdfIn PDF document text
  • https://s3.amazonaws.com/dozore/sabewadu.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/dd650afc-4f22-4384-9c2e-70934508aaa3/what_to_eat_on_alkaline_diet.pdfIn PDF document text
  • https://s3.amazonaws.com/pafiganovavi/43692337786.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8f581933-5132-4b97-a641-28639f11ea4a/23715144130.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/7dc60650-1902-408e-ac2c-1788a551545a/for_dummies_book_publisher.pdfIn PDF document text
  • http://duvipegi.epizy.com/english_grammar_questions_and_answers.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/421129e1-917d-4229-bccd-f50457a4dba6/adobe_premiere_free_download_for_windows_10_32_bit.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8e9f3126-647a-496a-b643-2e1838849842/28669163008.pdfIn PDF document text
  • https://s3.amazonaws.com/viboxikuz/tony_evans_bible_commentary_barnes_and_noble.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b06840f1-882a-4369-be71-b12453f7528b/gordon_ramsay_home_cooking.pdfIn PDF document text
  • http://demajipo.rf.gd/zavaxugosulik.pdfIn PDF document text
  • http://xesewopalokix.epizy.com/android_emulator_linux_google_play.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.