Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://yoyep.co.za/XSRYdR1H?utm_term=2017+cadillac+xt5+cue+manual PDF link annotation

  • http://kazbani.ru/kcfinder/upload/files/pavupelujejafejimirawat.pdfIn PDF document text
  • https://nordiskvillaventilation.dk/userfiles/file/zojupoxesagidefufir.pdfIn PDF document text
  • http://zhihepvb.com/upload/ckimg/files/202203011001579737.pdfIn PDF document text
  • https://iamluno.com/wp-content/plugins/formcraft/file-upload/server/content/files/16212814b6f349---46242536387.pdfIn PDF document text
  • http://richmediahouse.com/admin/uploads/file/jejomozixisefaf.pdfIn PDF document text
  • http://parfumerieindex.nl/images/uploads/56744174854.pdfIn PDF document text
  • https://hoangphatdanang.com/uploads/image/files/subenijajusanivenobijin.pdfIn PDF document text
  • https://schneider-rozetki.ru/kcfinder/upload/files/sovumosapafakebixamixagu.pdfIn PDF document text
  • https://www.indoorclub-informa.com/boletines/img/file/sobovamexokewajatoguvul.pdfIn PDF document text
  • http://brixtontaxi.com/survey/userfiles/files/30120231414.pdfIn PDF document text
  • http://terrigena.cz/data/pic/files/20309556966.pdfIn PDF document text
  • https://voctestbursa.org/editconsole/kcfinder/upload/files/44198631984.pdfIn PDF document text
  • https://www.karenlovelee.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621adfff4d25b---vipileza.pdfIn PDF document text
  • http://cloverdiamond.com/file/jekudoxowafij.pdfIn PDF document text
  • http://montaze.org/democms/userfiles/file/biroropusinodujenirekozot.pdfIn PDF document text
  • http://dekoblickfang.de/userfiles/file/firubuxazapabewi.pdfIn PDF document text
  • http://fazendasaojudastadeu.net/fotosempresa/files/getefajox.pdfIn PDF document text
  • http://euro520.net/userfiles/file/16440993531675345232.pdfIn PDF document text
  • http://bangdientunhk.com/upload/files/pumuxuwa.pdfIn PDF document text
  • https://atahca.pt/atahca_gestor/kcfinder/upload/files/95517627415.pdfIn PDF document text
  • https://iamtimeshare.com/userfiles/file/40302059556.pdfIn PDF document text
  • https://cheeselicious.net/UserFiles/file/wepafejusivo.pdfIn PDF document text
  • http://kedokteran.untan.ac.id/asset/ckeditor/plugins/kcfinder/upload/files/purobodiwogum.pdfIn PDF document text
  • http://mdtrend.hu/files/file/sipavub.pdfIn PDF document text
  • http://rewitex.pl/userfiles/file/zotimuresogojavav.pdfIn PDF document text
  • http://dmvsaram.dalsaram.com/fckeditor/userimages/file/20220210172551.pdfIn PDF document text
  • http://studiofelician.com/userfiles/files/75359451801.pdfIn PDF document text
  • http://sweatrinserepeat.com/ckfinder/userfiles/files/judeteruvug.pdfIn PDF document text
  • https://hobbyschuurtje-webwinkel.be/images/userfiles/file/10267112269.pdfIn PDF document text
  • https://lolakarimova.uz/ckfinder/userfiles/files/femixopawegevulijo.pdfIn PDF document text
  • http://copingconversations.com/userfiles/file/dovajudiduzavaregug.pdfIn PDF document text
  • http://gruaszarate.com/ckfinder/userfiles/files/77619320739.pdfIn PDF document text
  • https://www.marmaclbd.com/assets/ckeditor/kcfinder/upload/files/bavufozososeviwexa.pdfIn PDF document text
  • https://sapporopools.com/contents/files/wugowuzifadupowefif.pdfIn PDF document text
  • http://cn-junsheng.com/upload/file///2022222124688337.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0002af85.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0002af85.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.