Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://tevav.co.za/XSRYdR1H?utm_term=global+surfactants+market+report PDF link annotation

  • https://www.modianodesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/16189a26538570---mizovune.pdfIn PDF document text
  • http://www.bandungmesin.com/file/51663833481.pdfIn PDF document text
  • https://ecoquimica.cl/dinamicos/uploads/file/nomedifisigudexi.pdfIn PDF document text
  • https://hn-as.dk/sites/default/files/userfiles/file/zidipofosemise.pdfIn PDF document text
  • http://przystaneknida.pl/data/aktualnosci_imgs/file/berepozotovax.pdfIn PDF document text
  • http://teaandtiarasottawa.com/clients/e/e8/e8f54e69a7463df9fd0adff13cd8e90f/File/30645429790.pdfIn PDF document text
  • http://www.pattyn360.com/upload/forum/files/bumokewejorebolosoler.pdfIn PDF document text
  • http://gopherandsquirrelcontrol.com/admin/images/file/88202090893.pdfIn PDF document text
  • https://russiandance.ru/frontend/web/js/kcfinder/upload/files/22640607749.pdfIn PDF document text
  • https://ciiinnovationsummit.com/ci/userfiles/files/83620910961.pdfIn PDF document text
  • http://sibmaxi.ru/userfiles/file/62781586421.pdfIn PDF document text
  • http://icsbc.ru/fuploader//file/kanup.pdfIn PDF document text
  • http://sergeisurzhin.ru/ckfinder/userfiles/files/40124302472.pdfIn PDF document text
  • http://glassinter.de/kcfinder/upload/upload/levolewosaj.pdfIn PDF document text
  • http://eyupsifalibitkiler.com/resimler/files/tavuwosexesosanal.pdfIn PDF document text
  • http://np-laser.com/upload_fck/file/2021-7-10/20210710170041804874.pdfIn PDF document text
  • http://an-ocn.ru/ckfinder/userfiles/files/xinotuxibipebelo.pdfIn PDF document text
  • https://ladymamashop.com/uploads/files/202112230324321087.pdfIn PDF document text
  • https://georeno.ca/userfiles/files/welazirizitaletevadiz.pdfIn PDF document text
  • http://ave-france.com/pics/files/47740065065.pdfIn PDF document text
  • http://live-net.it/file/newiziv.pdfIn PDF document text
  • http://theorientgarden.iorderfoods.com/uploads/files/54653494955.pdfIn PDF document text
  • http://lauraestetica.com/userfiles/files/8008734872.pdfIn PDF document text
  • http://zonweringbelgie.be/ckfinder/userfiles/files/libepobox.pdfIn PDF document text
  • http://giadinhmedia.com/uploads/files/werovasupesusotelunes.pdfIn PDF document text
  • http://ambulanceservice.pl/userfiles/file/2578703524.pdfIn PDF document text
  • http://thermogroup.ru/uploads/files/dinixenaziruv.pdfIn PDF document text
  • http://bndweb.nl/upload/files/jezizuvetugo.pdfIn PDF document text
  • https://jfava.gemwareserp.com/userfiles/file/valanefemopofujo.pdfIn PDF document text
  • https://chinatupai.com/web/js/ckfinder/userfiles/files/dubimug.pdfIn PDF document text
  • http://sanruou.com/app/webroot/uploads/files/dopoxokepikegurevavofe.pdfIn PDF document text
  • http://hamandeggsclub.com/clients/e/ee/ee862789ee8b59d3f3d22261ccc35c80/File/vusuxinororirufotog.pdfIn PDF document text
  • http://mptech.vn/ckfinder/userfiles/files/wivapomemubon.pdfIn PDF document text
  • https://bluetact.com/locktactyuma/userfiles/file/sitijeditupokupo.pdfIn PDF document text
  • http://morebricks.com/ckfinder/userfiles/files/99851776142.pdfIn PDF document text
  • https://pasarangroup1.com/contents/files/dexenamepebenupazaf.pdfIn PDF document text
  • http://refinerlink.com/userfiles/file/21682345517.pdfIn PDF document text
  • https://songhong.info/userfiles/file/51364706063.pdfIn PDF document text
  • http://www.reroofingbrisbaneqld.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/161dc12cc174df---vosalakawatokamul.pdfIn PDF document text
  • https://sacc-la-chaux-de-fonds.ch/fichiers/file/vulopuperevemur.pdfIn PDF document text
  • https://notofthisgalaxy.com/wp-content/plugins/super-forms/uploads/php/files/bqr969r78rfs0q8vstall1fgai/82147664937.pdfIn PDF document text
  • https://fancybox.pamlskovnik.cz/ckfinder/userfiles/files/fovut.pdfIn PDF document text
  • http://nepaldristi.com/dbros/public/ckeditor/kcfinder/upload/files/82284646906.pdfIn PDF document text
  • http://zhuoxinlaw.com/userfiles/file/20220202030137_1130859639.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text

  +3 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.