Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• SEO-redirector lure link (multi-word utm_term) low PDF_SEO_UTM_REDIRECTOR_LINK
  PDF contains a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the search-keyword gateway used by the 'free document download' phishing family. Surfaced as an IOC; on its own this is a low-confidence signal.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jodemugibinid.weebly.com/uploads/1/3/5/3/135347277/6267d5ad607d02.pdf In PDF document text

  • https://wavixupenug.weebly.com/uploads/1/3/4/3/134386336/tatuletuj.pdfIn PDF document text
  • https://ledajesaler.weebly.com/uploads/1/3/4/0/134041179/8eb32a8ece6e.pdfIn PDF document text
  • https://amursvoidom.ru/media/files/99276117964.pdfIn PDF document text
  • https://luwanolukurodo.weebly.com/uploads/1/3/5/3/135397368/mifejij_mepuvokiralakis_limobulufifop.pdfIn PDF document text
  • https://pozagawev.weebly.com/uploads/1/3/4/5/134580069/tadono.pdfIn PDF document text
  • https://sawizajijon.weebly.com/uploads/1/4/1/3/141333648/1b4e39e11a.pdfIn PDF document text
  • https://bomutakarekavag.weebly.com/uploads/1/3/5/3/135330682/b7bcc0838e28e15.pdfIn PDF document text
  • https://jedirixaz.weebly.com/uploads/1/3/4/8/134875163/9fee5.pdfIn PDF document text
  • https://sakosewarelutu.weebly.com/uploads/1/4/1/3/141351704/d6bcd36.pdfIn PDF document text
  • https://didekupava.weebly.com/uploads/1/3/1/1/131163833/44a37.pdfIn PDF document text
  • https://zokagigapo.weebly.com/uploads/1/3/4/7/134719336/pizanega.pdfIn PDF document text
  • https://tufefuru.weebly.com/uploads/1/3/4/6/134621659/4284696.pdfIn PDF document text
  • https://nulupuro.weebly.com/uploads/1/3/4/5/134596779/1020813.pdfIn PDF document text
  • https://zokakunogik.weebly.com/uploads/1/4/1/4/141471848/16a2e4fbaed40.pdfIn PDF document text
  • https://ivantomanov.com/userfiles/file/zenutaxavitawerowawup.pdfIn PDF document text
  • https://bugevokugado.weebly.com/uploads/1/3/4/8/134870551/eba246d212.pdfIn PDF document text
  • http://bannails.com/fckeditor_userfiles/file/xijusubizuxabatufaru.pdfIn PDF document text
  • https://xatotaga.weebly.com/uploads/1/3/4/7/134726025/matijevov_dukika.pdfIn PDF document text
  • https://vuwejugo.weebly.com/uploads/1/3/4/3/134309576/mimoxino_lumokozonosoji_jiwuniz_wagab.pdfIn PDF document text
  • https://disipewadapa.weebly.com/uploads/1/3/4/8/134870645/sorowafudoru_rakuru_kogobupofiwel_zefosunenajo.pdfIn PDF document text
  • https://jodatonibidoxej.weebly.com/uploads/1/3/5/2/135297120/tutut.pdfIn PDF document text
  • https://pojaxereb.weebly.com/uploads/1/3/1/4/131482957/5028297.pdfIn PDF document text
  • https://xemaxokiba.weebly.com/uploads/1/3/4/3/134350412/75187e2b3c42.pdfIn PDF document text
  • https://zilexewutefak.weebly.com/uploads/1/3/4/6/134608169/8398690.pdfIn PDF document text
  • https://lifowedo.weebly.com/uploads/1/3/4/7/134707215/xevetejobax.pdfIn PDF document text
  • https://dafufiwe.weebly.com/uploads/1/3/4/3/134368649/fotaposutase.pdfIn PDF document text
  • http://esteticka-stomatologie.cz/files/content/file/losuv.pdfIn PDF document text
  • http://worldsocialistpartyindia.org/ckfinder/userfiles/files/53929408672.pdfIn PDF document text
  • https://wukopinanojud.weebly.com/uploads/1/4/1/4/141420080/guxokod.pdfIn PDF document text
  • http://tesorosdelayer.net/imgs/images/files/48419716998.pdfIn PDF document text
  • https://livadekawa.weebly.com/uploads/1/3/5/3/135317457/sudusefoxejizun.pdfIn PDF document text
  • https://xumotisububilup.weebly.com/uploads/1/3/4/5/134591263/a37c8.pdfIn PDF document text
  • http://bloemenwinkelindex.nl/images/uploads/datalojuruv.pdfIn PDF document text
  • https://paxazojip.weebly.com/uploads/1/3/0/8/130873894/9201486.pdfIn PDF document text
  • https://7m-shop.godyouoh.com/userfiles/file/dulalinavilewa.pdfIn PDF document text
  • https://siwusoxol.weebly.com/uploads/1/3/4/5/134584737/vufetabo.pdfIn PDF document text
  • https://pimotaro.weebly.com/uploads/1/3/3/9/133986821/7424657.pdfIn PDF document text
  • http://atreve.eu/ubezpiecz/obrazy/file/jiwituxojofavivojozep.pdfIn PDF document text
  • https://jepusorowuw.weebly.com/uploads/1/3/4/3/134370943/6516360.pdfIn PDF document text
  • http://www.jimenez-casquet.com/wp-content/plugins/formcraft/file-upload/server/content/files/162385c3d33726---volilevisoxubode.pdfIn PDF document text
  • https://wawadufuwo.weebly.com/uploads/1/4/1/4/141439533/722251.pdfIn PDF document text
  • https://daxuregivav.weebly.com/uploads/1/3/4/4/134431970/nufanedatotitajad.pdfIn PDF document text
  • https://dojulukasinu.weebly.com/uploads/1/3/0/7/130776790/e28a3d1.pdfIn PDF document text
  • https://wirut.co.za/XSRYdR1H?utm_term=astrometry.+net++index+filesPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text

  +3 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.