Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://yafferge.ru/aws?utm_term=how+to+write+chapter+4+results+and+discussion+in+qualitative+research In PDF document text

  • https://cdn.sqhk.co/tatogevi/Mh5hcgc/wusatusiwanuneritobu.pdfIn PDF document text
  • https://wovufimi.weebly.com/uploads/1/3/5/3/135327312/2011321.pdfIn PDF document text
  • https://repawuwo.weebly.com/uploads/1/3/5/3/135313919/edd68.pdfIn PDF document text
  • https://cdn.sqhk.co/lufezeralon/ejbjg6o/11940053637.pdfIn PDF document text
  • http://xevusezes.medianewsonline.com/what_to_say_about_your_background_in_an_interview.pdfIn PDF document text
  • https://bozobazevadetob.weebly.com/uploads/1/3/1/6/131607158/72298124d576199.pdfIn PDF document text
  • http://tujemet.scienceontheweb.net/math_book_class_10.pdfIn PDF document text
  • https://cdn.sqhk.co/likafupat/R2qqnoC/suguweku.pdfIn PDF document text
  • https://cdn.sqhk.co/zofizitene/ic91ieU/7688158092.pdfIn PDF document text
  • https://cdn.sqhk.co/kuderoxuz/dxJgjY5/besidu.pdfIn PDF document text
  • https://cdn.sqhk.co/gatidixon/iaSgcvI/jerad.pdfIn PDF document text
  • https://e3c65705-3664-417e-97b1-2ac29bfab8bd.filesusr.com/ugd/6a5da5_6cd4b7b8f2c54b2fbfcd4b64b9323e19.pdf?index=trueIn PDF document text
  • https://82cb18f6-4a40-4824-ac11-10070f72ce02.filesusr.com/ugd/5aec95_74753f4357474285ac9e83620df1eeea.pdf?index=trueIn PDF document text
  • https://327bbe42-9aa5-4ca0-80e5-6c9857058a26.filesusr.com/ugd/2b870b_92acc7f6f8ce4f728057c813697505d3.pdf?index=trueIn PDF document text
  • https://e57d8632-f742-4524-ada6-9cdf759d9f13.filesusr.com/ugd/b0cb2d_597d308b3c3a43c5b7dd24c01487f0ba.pdf?index=trueIn PDF document text
  • https://b2f02272-107b-4032-aafc-54cdd6265a16.filesusr.com/ugd/6cf392_32afe2b8f6384590b8c8b69fe00c670d.pdf?index=trueIn PDF document text
  • https://fa202315-5cd5-4006-9a99-7c5d4406650e.filesusr.com/ugd/61804c_8e7fc57c7d424d8da4afdc3a24f987c3.pdf?index=trueIn PDF document text
  • https://d3826037-6016-486c-99e9-dc41bc666644.filesusr.com/ugd/b81754_83cf43a993ab499b9aefd5232e9b6700.pdf?index=trueIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.