Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Malformed active-content stream length medium PDF_MALFORMED_EXPLOIT_STREAM_LENGTH
  A PDF stream that carries active/exploit-looking content has a declared /Length that does not match the recovered stream body. Malformed stream boundaries and length mismatches are common parser-evasion/supporting evidence around Reader exploit streams.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://loheb.co.za/XSRYdR1H?utm_term=scale+of+the+solar+system+worksheet+answer+key+2020+list PDF link annotation

  • https://earthchartercities.org/wp-content/plugins/formcraft/file-upload/server/content/files/1620b40128ea40---60335192078.pdfIn PDF document text
  • https://smobiil.eu/userfiles/files/dimadejikedibuzu.pdfIn PDF document text
  • https://www.lacasadeltecle.com/imagenes/editor/file/1954907981.pdfIn PDF document text
  • https://tusidotug.weebly.com/uploads/1/3/4/4/134482214/renirarager.pdfIn PDF document text
  • https://bovimifukid.weebly.com/uploads/1/3/4/8/134882826/sebimeru_ditagefopegubi.pdfIn PDF document text
  • https://bejakujenexal.weebly.com/uploads/1/3/4/8/134890937/4d8d2c3b24fd.pdfIn PDF document text
  • https://europawindow.com/app/webroot/img/main_content/files/limanib.pdfIn PDF document text
  • https://tanutalavisa.weebly.com/uploads/1/3/4/0/134000413/b99bbfa2.pdfIn PDF document text
  • https://gejabawegidorar.weebly.com/uploads/1/4/1/3/141379564/bbe8036.pdfIn PDF document text
  • https://xefewovureku.weebly.com/uploads/1/3/4/2/134265706/reximesatefilixoze.pdfIn PDF document text
  • https://deltagroup.bg/uploads/file/vudon.pdfIn PDF document text
  • http://abevenement.com/kcfinder/upload/files/fekaka.pdfIn PDF document text
  • https://jasevumoxemu.weebly.com/uploads/1/3/4/7/134707335/7c27652dc4314c.pdfIn PDF document text
  • http://htygroup.com/upload/files/5213159875.pdfIn PDF document text
  • https://jarowezib.weebly.com/uploads/1/3/0/8/130813985/saluxidowo_remuse_peturadivibewox.pdfIn PDF document text
  • https://zilipukemu.weebly.com/uploads/1/4/1/2/141218135/5273685.pdfIn PDF document text
  • http://outforced.mdei.info/ckfinder/userfiles/files/93959497229.pdfIn PDF document text
  • https://baschin-heizung.de/meineBilderAlbertGrundschule/file/waloraweloninomo.pdfIn PDF document text
  • https://bajkolandia.halpress.eu/userfiles/file/sazemixadoziwemare.pdfIn PDF document text
  • https://duzinalanidik.weebly.com/uploads/1/3/4/7/134760416/rejag.pdfIn PDF document text
  • https://www.sdhbd.org/backend/web/kcfinder/upload/files/54722880613.pdfIn PDF document text
  • http://www.melodypods.com/wp-content/plugins/formcraft/file-upload/server/content/files/1622a5c49131e2---sodin.pdfIn PDF document text
  • https://mejodedasebedo.weebly.com/uploads/1/3/4/7/134725949/46d1af.pdfIn PDF document text
  • https://thoitranghn.com/userfiles/file/jedezojarelexi.pdfIn PDF document text
  • https://kepogopinojolar.weebly.com/uploads/1/4/1/3/141390308/zimef.pdfIn PDF document text
  • https://ruwelijowabol.weebly.com/uploads/1/3/4/3/134307429/nojokitumawitug.pdfIn PDF document text
  • http://portalpr-b2b.es/img/user//file/_0212337001646597465.pdfIn PDF document text
  • https://vedalamiru.weebly.com/uploads/1/3/0/7/130776143/nozifi_disaj_rosuw.pdfIn PDF document text
  • https://lovevisop.weebly.com/uploads/1/3/1/4/131410094/3341025.pdfIn PDF document text
  • http://kochi-east-rc.com/admin/kcfinder/upload/files/41100871915.pdfIn PDF document text
  • https://bikubelefa.weebly.com/uploads/1/3/1/6/131606475/34e4bacf0b342f2.pdfIn PDF document text
  • https://pobanuti.weebly.com/uploads/1/3/1/4/131437932/c4aa6afe.pdfIn PDF document text
  • https://zujituxo.weebly.com/uploads/1/3/2/6/132681889/6039218.pdfIn PDF document text
  • https://gulecbakliyat.com/panel/kcfinder/files/xakobatojesopekeforasana.pdfIn PDF document text
  • https://rowabogepabi.weebly.com/uploads/1/4/1/2/141281111/biruwugijaj-xutosuv-gonegupi-kexusuga.pdfIn PDF document text
  • https://gbrcbodhgaya.com/userfiles/file/42611992609.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.