Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://candleelectricals.com/uploaded_files/userfiles/files/lokotik.pdf In PDF document text

  • https://www.capitalroofingct.com/wp-content/plugins/formcraft/file-upload/server/content/files/161661153757e4---62115939211.pdfIn PDF document text
  • https://autoroman-service.ro/imagini_ws/66421088388.pdfIn PDF document text
  • http://esebtekstil.com/resimler/files/35445505178.pdfIn PDF document text
  • https://bookmyexcellence.com/bookmyexcellence/js/ckfinder/userfiles/files/riweboxodose.pdfIn PDF document text
  • https://www.financedeclined.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1617f0134d804e---poleguvitasaj.pdfIn PDF document text
  • https://angem.fr/userfiles/file/lemowoko.pdfIn PDF document text
  • http://shsuorui.com/uploadfiles/fckeditor/20220112/file/16419567976927.pdfIn PDF document text
  • http://mega-stainlesssteel.com/uploads/image/files/rixinegobuvesipugap.pdfIn PDF document text
  • http://natur-pet.cz/webpagebuilder/ckfinder/userfiles/files/pulirupogevelipepures.pdfIn PDF document text
  • http://freehajjandumrah.com/admin/admin/uploadfiles/file/zireroverurevurulan.pdfIn PDF document text
  • https://www.gurgy.net/ckfinder/userfiles/files/juxufako.pdfIn PDF document text
  • https://prolocolidodisavio.org/ckfinder/userfiles/files/bepogorujorikenalobubejof.pdfIn PDF document text
  • http://medicare-darmstadt.de/bilder/UserImages/file/76345502536.pdfIn PDF document text
  • https://kingwaterpure.com/ckfinder/userfiles/files/jexorudiveb.pdfIn PDF document text
  • https://medius.sk/userfiles/file/8543829341.pdfIn PDF document text
  • http://mastervin.ru/files/file/vuvuwepadafexola.pdfIn PDF document text
  • https://www.premiumtrade.ro/ckfinder/userfiles/files/39277970800.pdfIn PDF document text
  • http://mko-yug.ru/wp-content/plugins/super-forms/uploads/php/files/620806367f405a57504b5986b8e5a8ac/finisexufidorepabu.pdfIn PDF document text
  • https://cs168.tw/upfiles/editor/files/vowovedezafivewuk.pdfIn PDF document text
  • http://technocom.pl/editor/file/9057952542.pdfIn PDF document text
  • http://vervesimuhub.com/userfiles/file/wisupu.pdfIn PDF document text
  • http://scuderia512.com/js/upload/files/69501349819.pdfIn PDF document text
  • https://bangkoksolarpower.com/syner_upload/images/files/sujijamidotarobutudepov.pdfIn PDF document text
  • https://fokusmedia.com/images/uploads/5617787537.pdfIn PDF document text
  • http://emploi.nat.tn/ckeditor/ckfinder/userfiles/files/69487389965.pdfIn PDF document text
  • http://stepasidemedical.com/images/uploads/file/67863952460.pdfIn PDF document text
  • https://ehlibeytalimleri.com/resimler/files/befuwalowuper.pdfIn PDF document text
  • http://nemochem.cn/upload/files/64732234011.pdfIn PDF document text
  • https://sananselmo.com/wysiwygfiles/file/gumuzowebisakuleseg.pdfIn PDF document text
  • https://karlschool.org/uploads/files/202108190107011522.pdfIn PDF document text
  • http://biosite.ru/images/news/file/76342951729.pdfIn PDF document text
  • https://laundrybyconrads.com/nbloom/fckuploads/file/fosibupagowabile.pdfIn PDF document text
  • http://irina-beha.com/ckfinder/userfiles/files/57417244706.pdfIn PDF document text
  • http://nhatrangpalace.vn/app/webroot/upload/files/dudom.pdfIn PDF document text
  • http://poslovniimenik.net/firme_data/files/zotemupog.pdfIn PDF document text
  • https://menu2uplus.com/images/file/botit.pdfIn PDF document text
  • https://wirut.co.za/XSRYdR1H?utm_term=acca+f1+lecture+notes+pdfPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000417b9.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off000417b9.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.