Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• SEO-redirector lure link (multi-word utm_term) low PDF_SEO_UTM_REDIRECTOR_LINK
  PDF contains a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the search-keyword gateway used by the 'free document download' phishing family. Surfaced as an IOC; on its own this is a low-confidence signal.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://lovig.co.za/XSRYdR1H?utm_term=cartoon+videos++free PDF link annotation

  • https://zohopinler.com/calisma2/files/uploads/minexugowod.pdfIn PDF document text
  • http://aadcnfgl.netsociality.com/upload/files/koxabirijekikoj.pdfIn PDF document text
  • http://studioturina.com/userfiles/files/nawebuxirafivibarij.pdfIn PDF document text
  • http://gdgom.com/upload/file/220221123646506185j3y77olle6s1.pdfIn PDF document text
  • http://www.crislbd.com/public/admin/assets/ckeditor/kcfinder/upload/files/zaveroxedabix.pdfIn PDF document text
  • http://hyswimpool.com/userfiles/dusatizejaluvosevi.pdfIn PDF document text
  • https://placc.info/up_image/97319445418.pdfIn PDF document text
  • http://kahsport.cz/userfiles/file/7277493942.pdfIn PDF document text
  • http://pol2-simf.ru/userfiles/file/padilugenutewiwir.pdfIn PDF document text
  • https://topupdana.com/contents/files/gaxunelututiradadopozaje.pdfIn PDF document text
  • http://spc1991.com/ckfinder/userfiles/files/15158466901.pdfIn PDF document text
  • https://togeltop.net/contents/files/3563034532.pdfIn PDF document text
  • http://yuha.be/_files/file/novugeluwisafuzitodajor.pdfIn PDF document text
  • https://quimicasorocolor.com.ve/ckfinder/userfiles/files/rukudepubujebataruvuzog.pdfIn PDF document text
  • https://christavedelaar.nl/bestanden/files/tokifi.pdfIn PDF document text
  • http://terrigena.cz/data/pic/files/sededivoveb.pdfIn PDF document text
  • https://myoffice.strategygroupglobal.com/uploads/files/dagamirewoma.pdfIn PDF document text
  • http://beautystyln.jp/uploads_file/files/74812901781.pdfIn PDF document text
  • http://moonlightmontessori.com/upload/files/96276867481.pdfIn PDF document text
  • http://japhina.com/upload/file/zaluwowesugatanitedusiw.pdfIn PDF document text
  • https://share.linkilike.com/libraries/kcfinder/upload/files/vokilobezerakujazusobi.pdfIn PDF document text
  • https://propbrains.com/wp-content/plugins/super-forms/uploads/php/files/37a889705adbee02b0ae0e5f4854fcb2/97236279493.pdfIn PDF document text
  • http://bangtaisay.com/uploads/userfiles/file/wemow.pdfIn PDF document text
  • http://rideabikenews.com/user_img/files/pukibezoj.pdfIn PDF document text
  • https://stehovani-ostrava.cz/static_pages_files/file/xosakavawopotetuganudijez.pdfIn PDF document text
  • https://plastr.cz/files/files/vusulatazeloguvenuzepos.pdfIn PDF document text
  • http://loca-granderoue-montaletang.com/ckfinder/userfiles/files/womurimozir.pdfIn PDF document text
  • https://leeleather.net/userfiles/file/perofuzonumerezavolix.pdfIn PDF document text
  • http://coquicart.com/ckeditor/ckfinder/core/connector/php/uploads/files/36879342947.pdfIn PDF document text
  • http://www.agrosystem.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/161fb802db2bd1---jupitokivedikijuzevidev.pdfIn PDF document text
  • http://ratchadatitan.com/UserFiles/File/5721456952.pdfIn PDF document text
  • https://cribpointonline.org/cribpointonline/userimages/file/21465715470.pdfIn PDF document text
  • https://gmonlinestore.com/wp-content/plugins/formcraft/file-upload/server/content/files/162066b9b9aaec---45300717382.pdfIn PDF document text
  • http://avtokapriz42.ru/userfiles/file/86434658913.pdfIn PDF document text
  • http://barrarioservicos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16208b7213f453---sufawafajiguxapomibofido.pdfIn PDF document text
  • https://cullinanconstruction.com/wp-content/plugins/super-forms/uploads/php/files/aknejuqo9uk2rp9ii6ge8p364p/jodix.pdfIn PDF document text
  • http://partynfun.com/kcfinder/upload/files/kezizozigatuzowodi.pdfIn PDF document text
  • https://aurastaffing.es/upload/file/48077857811.pdfIn PDF document text
  • http://tvkinter.com/file_media/file_image/file/36444982058.pdfIn PDF document text
  • http://gdlianyu.com/uploadfiles/file/zopuguvelazetilil.pdfIn PDF document text
  • https://branpc.in/ckfinder/userfiles/files/nejekowixajivenip.pdfIn PDF document text
  • http://cascad-trans.ru/files/mopumevuwaxijogodeniv.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00097087.bin)

  +1 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.