Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://sunuf.co.za/XSRYdR1H?utm_term=2015+kia+sedona PDF link annotation

  • http://www.kyousei-fukushi.or.jp/system/ckfinder/userfiles/files/zevelu.pdfIn PDF document text
  • http://www.debreceni-fogaszat.hu/js/ckeditor/kcfinder/upload/files/deluniritovipifurizin.pdfIn PDF document text
  • https://kapokcmassage.com/uploads/files/202203091200136383.pdfIn PDF document text
  • http://andrenickels.de/ckfinder/userfiles/files/teponuwumi.pdfIn PDF document text
  • https://ppic.net-line.pl/www/js/kcfinder/upload/files/89428761157.pdfIn PDF document text
  • http://www.sfainternational.pk/assets/ckeditor/kcfinder/upload/files/26523988871.pdfIn PDF document text
  • https://gestionarival.com/userfiles/file/37763739747.pdfIn PDF document text
  • https://traicaygiasi.com/Images_upload/files/sasagurovigujoropenazuz.pdfIn PDF document text
  • http://tbeaindia.com/userfiles/file/guwogudejekijefisoveti.pdfIn PDF document text
  • https://marugame.hk/editor_upload/file/kitapiwitokizo.pdfIn PDF document text
  • https://empresa-venta.hr/files/sujivawunaxariti.pdfIn PDF document text
  • https://evrenmentese.com/upload/ckfinder/files/runasuzapegewomi.pdfIn PDF document text
  • https://pmb.unimal.ac.id/assets/plugin/kcfinder/upload/files/40682434498.pdfIn PDF document text
  • http://doremimarlikinsaat.com/userfiles/file/bututoluwipad.pdfIn PDF document text
  • http://evola.it/userfiles/files/70440571980.pdfIn PDF document text
  • http://augustaelectricalwork.com/editorData/file/nejidebuvunam.pdfIn PDF document text
  • http://handinks.com/ckfinder/images_store/files/xaxujozejamebizeworolu.pdfIn PDF document text
  • http://potya.com/givatazotutozezidatijadam.pdfIn PDF document text
  • https://servicio-mexico.com/images/file/pifujopetubojutegite.pdfIn PDF document text
  • https://dulichduyendangvietnam.com/uploads/news_file/87583941761.pdfIn PDF document text
  • https://peisheng.org/uploads/ckfiles/files/6208d9ada66c8.pdfIn PDF document text
  • http://medlabtests.com/kcfinder/upload/files/zunep.pdfIn PDF document text
  • https://cashcruis.ru/wp-content/plugins/super-forms/uploads/php/files/9d0d7992e24191c4a3526239b9bda300/37831783756.pdfIn PDF document text
  • https://dhrc.in/userfiles/file/78701826707.pdfIn PDF document text
  • http://grv.arq.br/admin/kcfinder/upload/files/pasatofewa.pdfIn PDF document text
  • https://www.stock2morrow.com/ckfinder/userfiles/files/tujizubav.pdfIn PDF document text
  • http://neodentpetrosino.it/userfiles/files/tazupogekimugiwekiz.pdfIn PDF document text
  • https://krygina40.ru/UserFiles/File/tozew.pdfIn PDF document text
  • http://www.dieseproductions.com/upload/customNews/files/24116897762.pdfIn PDF document text
  • http://elektrostroy.kz/ckfinder/userfiles/files/14404889571.pdfIn PDF document text
  • http://ci-tesco.com/kcfinder/upload/files/toxuzitunevepomobopuni.pdfIn PDF document text
  • https://caviar.md/kcfinder/upload/files/zipusu.pdfIn PDF document text
  • http://gewidor-gmbh.de/uploads/files/zajejakunavegesepunawoxe.pdfIn PDF document text
  • http://www.roosprommenschenckelfoundation.nl/ckfinder/files/files/63543409964.pdfIn PDF document text
  • https://rekoprint.cz/files/ckfiles/file/65080593467.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0004bbb1.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0004bbb1.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.