Malicious PDF — malware analysis report

Heuristics 8

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
  Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• PDF advertises pirated movie streaming/download medium PDF_PIRACY_STREAMING_LURE
  PDF rendered text advertises free full-movie streaming or download using piracy-brand names or a 'full movie + download/free/watch' intent phrase — recovered after folding the styled Unicode confusables the campaign uses to hide those keywords from plain-text detection. These are disposable SEO-spam carriers that route users to malvertising, fake-player, and scam pages; the PDF itself is inert.
• SEO-redirector lure link (multi-word utm_term) low PDF_SEO_UTM_REDIRECTOR_LINK
  PDF contains a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the search-keyword gateway used by the 'free document download' phishing family. Surfaced as an IOC; on its own this is a low-confidence signal.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://yubit.co.za/XSRYdR1H?utm_term=aadhar+card++on+mobile+phone PDF link annotation

  • http://liebherr-tr.com/userfiles/file/30524663578.pdfIn PDF document text
  • http://www.atad.ae/emanager/assets/ckeditor/plugins/kcfinder/upload/files/nalugekosukavanuzelu.pdfIn PDF document text
  • http://superfasttv.com/uploads/files/79246163736.pdfIn PDF document text
  • http://j1medical.com/uploaded/file/58377501725.pdfIn PDF document text
  • http://www.jatekkalmesevel.hu/admin/ckeditor/kcfinder/upload/files/91398466066.pdfIn PDF document text
  • http://niezapominajkowo.eu/userfiles/file/jotapomaguzujixaluk.pdfIn PDF document text
  • https://comfortinnbarrie.com/phpsites/vertical_living/uploads/file/47263058773.pdfIn PDF document text
  • http://nakamurasangyou.jp/app/webroot/uploads/files/xuxuzekowigewovo.pdfIn PDF document text
  • http://www.champcaregivers.com/wp-content/plugins/formcraft/file-upload/server/content/files/16226bfedebfc5---26125189197.pdfIn PDF document text
  • https://rheinfurth.de/userfiles/file/zodapajepopiveru.pdfIn PDF document text
  • http://ongxoanhdpe.vn/upload/files/60047671123.pdfIn PDF document text
  • http://theindianaccountant.com/pa/trainstation/uploads/image/file/44733225653.pdfIn PDF document text
  • https://creationstationdance.com/wp-content/plugins/formcraft/file-upload/server/content/files/162498b8f37ae3---govisanadow.pdfIn PDF document text
  • http://immobiliareborghi.com/userfiles/files/badovagedomujima.pdfIn PDF document text
  • http://gerd-pollak.de/userfiles/file/tigazuwiludi.pdfIn PDF document text
  • http://redeyeldn.com/userfiles/file/kebuvimewilawubipipajurev.pdfIn PDF document text
  • http://24horasnoar.com.br/ckfinder/userfiles/files/93692584620.pdfIn PDF document text
  • http://nikolabartakova.cz/files/file/75916526486.pdfIn PDF document text
  • https://profession-your-dr.com/uploads/files/202202240903174341.pdfIn PDF document text
  • http://drinkandshrink.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16260e109e46e7---65361590425.pdfIn PDF document text
  • http://tianlanip.com/filespath/files/20220429192031.pdfIn PDF document text
  • https://www.v-investor.ru/kcfinder/upload/files/nexawiwuzanesidagirudile.pdfIn PDF document text
  • https://asztromiskolc.hu/ckfinder/userfiles/files/94511567580.pdfIn PDF document text
  • http://familiegravesen.dk/userfiles/file/59152620771.pdfIn PDF document text
  • http://kasintorn.com/images/upload/files/54671864595.pdfIn PDF document text
  • https://nesbedcollege.com/singhania/downloads/file/72155683115.pdfIn PDF document text
  • https://www.sudoku-cool.com/ckfinder/userfiles/files/96044720731.pdfIn PDF document text
  • https://volgogradexpo.ru/ckfinder/userfiles/files/pusigugusoj.pdfIn PDF document text
  • https://adikmanis.com/contents/files/30832079931.pdfIn PDF document text
  • https://istanajp2.com/contents/files/rejadolojum.pdfIn PDF document text
  • http://alisawedding.com/upload/users/files/33384009974.pdfIn PDF document text
  • http://bilasiparacollege.org/assets/kcfinder/upload/files/nomekeruzizejegige.pdfIn PDF document text
  • http://muabannhagiare.net/images/uploads/files/80476097834.pdfIn PDF document text
  • http://zs.tom.ru/jsplugins/ckfinder/userfiles/files/91489520601.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0002d3da.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0002d3da.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.