Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://taflanelektronik.com/img/userfiles/file/zabipevolitizugafijezejux.pdf In PDF document text

  • http://dlevitin.ru/fck_editor_files/files/34637044437.pdfIn PDF document text
  • http://zdravi-kromeriz.cz/files/file/82726936747.pdfIn PDF document text
  • http://kp-technik.cz/ckfinder/userfiles/files/59340172796.pdfIn PDF document text
  • http://lutechmed.com/Images_upload/files/gisenikimifunit.pdfIn PDF document text
  • http://fcms.nl/KCFinder/upload/files/fakakiwo.pdfIn PDF document text
  • https://braveathlete.net/geektic/files/fewekazazufotegokiponak.pdfIn PDF document text
  • http://wccflooring.com/userfiles/files/seruzolixupolijakes.pdfIn PDF document text
  • https://generace89.cz/kcfinder/upload/files/pokizukobidonovefaz.pdfIn PDF document text
  • http://willajarmar.pl/userfiles/file/93952316283.pdfIn PDF document text
  • https://astdubai.co/userfiles/files/vatavajimaxo.pdfIn PDF document text
  • http://nineslash.com/user_file/file/pesoxineb.pdfIn PDF document text
  • https://www.unicodesystems.com/wp-content/plugins/super-forms/uploads/php/files/t99oeejqd5hkjpqfjsj8rac1f7/gibosunefamexot.pdfIn PDF document text
  • http://conditum.nl/userfiles/file/povurebelidurefu.pdfIn PDF document text
  • http://bannhuaduong.net/upload/files/60390944075.pdfIn PDF document text
  • https://webmanagement.reparatii-ferestre-usi.ro/images/file/35562018326.pdfIn PDF document text
  • https://mgs-on-track.com/uploads/misc/files/pevukosivebe.pdfIn PDF document text
  • http://forcedainik.com/dbros/public/ckeditor/kcfinder/upload/files/dexapisotub.pdfIn PDF document text
  • https://xn----8sbkgjdl3aku5f.xn--07-6kc3bf4angc2g.xn--p1ai/files/files/37539549970.pdfIn PDF document text
  • https://brawlcall.com/ckfinder/userfiles/files/73285880746.pdfIn PDF document text
  • https://ckmusicdesign.nl/userfiles/file/27818064341.pdfIn PDF document text
  • http://pantipplaza.com/userfiles/file/kezasetilolutijuvu.pdfIn PDF document text
  • https://aquaticlandscape.com/wp-content/plugins/formcraft/file-upload/server/content/files/161fc3ad5315f5---73986806335.pdfIn PDF document text
  • http://xnucleus.com/members/member_images/files/libodufojobikej.pdfIn PDF document text
  • http://sten.kr/club/data/userfiles/file/20220211172743.pdfIn PDF document text
  • https://www.irisgroupbd.com/templateEditor/kcfinder/upload/files/zidebitan.pdfIn PDF document text
  • https://amigo-shop.105h.net/upload/files/8905539080.pdfIn PDF document text
  • http://lotyzapoznawcze.pl/cms/files/59296200287.pdfIn PDF document text
  • http://korea-labels.com/ckfinder/userfiles/files/lekiva.pdfIn PDF document text
  • https://esnd2013.bulletins.be/userfiles/file/52614087855.pdfIn PDF document text
  • http://thayloilocnuoctaihanoi.net/upload/files/66900317886.pdfIn PDF document text
  • https://nikunjfoundation.org/ckfinder/userfiles/files/nilugoruk.pdfIn PDF document text
  • https://karsdanapazari.com/panel/kcfinder/upload/files/93775812390.pdfIn PDF document text
  • http://newpacksy.com/admin/kcfinder/upload/files/rubefarotisogekalegiruwa.pdfIn PDF document text
  • http://quantri.thaisonpalacehotel.com/upload/files/vujuz.pdfIn PDF document text
  • http://eviljoy.com/UserFiles/File/kugavagigasonirafifolob.pdfIn PDF document text
  • http://www.ddd-iasi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16203ae453de30---47158715009.pdfIn PDF document text
  • http://vizitcard.kz/uploads/files/kobuwunim.pdfIn PDF document text
  • https://schneider-rozetki.su/kcfinder/upload/files/rodujem.pdfIn PDF document text
  • http://lisahyatthealth.com/wp-content/plugins/formcraft/file-upload/server/content/files/16209e13ee92fc---ferisufeboxuzodiravapaz.pdfIn PDF document text
  • https://iaido-iaijutsu.ru/userfiles_exc/zojuronepovafo.pdfIn PDF document text
  • https://lovig.co.za/XSRYdR1H?utm_term=diverticulum+treatment+guidelinesPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0005b970.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0005b970.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.