Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• QR-code redirect lure medium SE_QR_LURE
  Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://tevav.co.za/XSRYdR1H?utm_term=auto+repair+service+manuals+online PDF link annotation

  • https://jewelalebun.weebly.com/uploads/1/3/4/5/134585336/lopobefubewidu_gapezufezobiwu_remiv.pdfIn PDF document text
  • https://simebofes.weebly.com/uploads/1/3/1/4/131438459/1615334.pdfIn PDF document text
  • https://rofibefis.weebly.com/uploads/1/3/4/1/134131293/fcebbd270.pdfIn PDF document text
  • http://thesecurityguardunion.ca/userfiles/files/watojenisokunejowunifaw.pdfIn PDF document text
  • http://solamsys.com/userData/board/file/52534150995.pdfIn PDF document text
  • http://asbufestival.com/uploads/FCK_files/file/4582163549.pdfIn PDF document text
  • https://autopits-directo.migrupoq.com/ckfinder/userfiles/files/228761601.pdfIn PDF document text
  • https://kopejupamuv.weebly.com/uploads/1/4/1/3/141318798/318f6ad16.pdfIn PDF document text
  • https://zivixitusinuz.weebly.com/uploads/1/3/1/3/131380786/7789174.pdfIn PDF document text
  • https://sijipovaxeku.weebly.com/uploads/1/3/4/3/134364773/9229270.pdfIn PDF document text
  • https://kokesekodabese.weebly.com/uploads/1/3/4/0/134012443/mogujinev-mosen-jener-solozajixuwa.pdfIn PDF document text
  • https://risidetumul.weebly.com/uploads/1/3/4/3/134320066/9035290.pdfIn PDF document text
  • https://lijipipixeralof.weebly.com/uploads/1/3/3/9/133999964/6095162.pdfIn PDF document text
  • https://xovodozavaso.weebly.com/uploads/1/3/1/0/131069890/333731.pdfIn PDF document text
  • http://dmychadla.eu/UserFiles/File/96268919942.pdfIn PDF document text
  • http://kiko168.com/UploadFile/file/20220222041721330.pdfIn PDF document text
  • https://xuxufagitagagi.weebly.com/uploads/1/3/0/7/130740521/zexudixonijufufofaja.pdfIn PDF document text
  • https://www.colfacor.org.ar/administrador_web/kcfinder/upload/files/nabigavatupisogovufub.pdfIn PDF document text
  • https://raxazejopife.weebly.com/uploads/1/3/5/3/135313527/7501020.pdfIn PDF document text
  • https://xadaxiwunitari.weebly.com/uploads/1/3/0/8/130814235/fixeku.pdfIn PDF document text
  • https://enilubricant.hoakhanh.vn/uploads/image/files/wixefigesux.pdfIn PDF document text
  • https://kerumesuni.weebly.com/uploads/1/3/4/1/134131613/d9680b2.pdfIn PDF document text
  • http://dagmare.de/userfiles/file/luxomelipuzobunibop.pdfIn PDF document text
  • https://nolaxefipox.weebly.com/uploads/1/3/4/7/134740184/sidalijosopufug.pdfIn PDF document text
  • https://vakejijumusefuv.weebly.com/uploads/1/3/5/3/135313512/xerasab_turolopet_banoregizujugog_xujedepixujuzuw.pdfIn PDF document text
  • http://prasongp.com/file_media/file_image/file/bozigifoxudagifasom.pdfIn PDF document text
  • https://tagakokiginozol.weebly.com/uploads/1/3/0/7/130775172/novusurajekili.pdfIn PDF document text
  • http://www.avtoschool71.ru/kcfinder/upload/files/41208001498.pdfIn PDF document text
  • http://medi-sen.com/files/files/42213039688.pdfIn PDF document text
  • http://reckdance.pl/userfiles/file/88069156365.pdfIn PDF document text
  • http://mygiftltd.com/userfiles/file/27726542380.pdfIn PDF document text
  • https://dojibosuxuzepi.weebly.com/uploads/1/3/1/3/131378780/bemanerixafagutisari.pdfIn PDF document text
  • https://kodupupagunoj.weebly.com/uploads/1/3/4/3/134314474/5952583.pdfIn PDF document text
  • https://gokododilu.weebly.com/uploads/1/3/4/5/134578034/setezofisor.pdfIn PDF document text
  • https://lorufolirosob.weebly.com/uploads/1/3/4/5/134584190/kovewobalasoto.pdfIn PDF document text
  • https://mozijazese.weebly.com/uploads/1/3/4/4/134460989/wovenegosuxaxakulosa.pdfIn PDF document text
  • http://perfecturology.cafe24.com/upload/editor/imagefile/32885097535.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0006565e.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0006565e.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.