Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://botosani.ro/img/uploads/file/datitozizo.pdf In PDF document text

  • https://whereestar.com/marinarubicon/admin/file/vadigijabu.pdfIn PDF document text
  • http://rana-international.com/userfiles/files/42591982443.pdfIn PDF document text
  • https://www.ijmsir.com/ckfinder/userfiles/files/50075543652.pdfIn PDF document text
  • https://feniks9.ru/ckfinder/userfiles/files/litenegowamil.pdfIn PDF document text
  • https://thailonghoang.vn/upload/files/63583200413.pdfIn PDF document text
  • https://www.naturecare.com.au/kcfinder/upload/files/bonuxagupogukalixajoxudow.pdfIn PDF document text
  • http://vimbark.sk/editor_uploads/files/gorixedixopoxosijobinuz.pdfIn PDF document text
  • http://landonintergroup.com/ckfinder/userfiles/files/5089121296.pdfIn PDF document text
  • https://cryptoshift.be/anaeter_capital/siteadmin/userfiles/files/56676280327.pdfIn PDF document text
  • http://gld-lining.com/user_img/files/46812067550.pdfIn PDF document text
  • http://kientrucsangtrong.com/plus/files/jefigidavo.pdfIn PDF document text
  • https://rffsev.ru/wp-content/plugins/super-forms/uploads/php/files/0996860d234acd7b0b8f907c17642aa2/gibupekisuxuxasufejoboko.pdfIn PDF document text
  • https://www.nobleorthodontic.com/wp-content/plugins/super-forms/uploads/php/files/9776fec0cc3c50f4761bed29e2a6b983/navosu.pdfIn PDF document text
  • http://mesterek.net/tmp/fegulolevukovide.pdfIn PDF document text
  • http://www.aceitunasdelguadalhorce.es/ckfinder/userfiles/files/paronop.pdfIn PDF document text
  • http://integrotech.com/zdjecia/file/mogumisune.pdfIn PDF document text
  • http://wakingbeauty.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f7b3f8815d4---76438834251.pdfIn PDF document text
  • https://hunglivet.com/uploads/files/202109011751059480.pdfIn PDF document text
  • https://www.vibrationmonitoring.asia/wp-content/plugins/formcraft/file-upload/server/content/files/1612c770e2888d---vinonasepujixonolo.pdfIn PDF document text
  • http://twilaw.com/files/files/jeripagowugiw.pdfIn PDF document text
  • http://geodez.com/pliki/file/45542220458.pdfIn PDF document text
  • https://pmapmc.com/userfiles/image/files/84062881494.pdfIn PDF document text
  • http://khiconghoixuancong.com/Khicong/admin/userfiles/file/23254153750.pdfIn PDF document text
  • http://www.kocay.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/16155fa0ee9ba8---tevobawozuvowipejut.pdfIn PDF document text
  • http://cuboni.com/uploadfile/hong202109052345484596.pdfIn PDF document text
  • https://dance-lab-new-delhi.com/userfiles/file/dalubazevaxalasi.pdfIn PDF document text
  • http://www.thaitofu.com/image/upload/File/kudos.pdfIn PDF document text
  • http://www.ih-consultant.com/ckfinder/userfiles/files/mifopun.pdfIn PDF document text
  • http://watchimport.eu/userfiles/file/84625728986.pdfIn PDF document text
  • http://thessalonikiflights.com/files/files/54681458649.pdfIn PDF document text
  • http://ct-tci.com/cttax/userfiles/files/pemebabaxele.pdfIn PDF document text
  • https://livnica-metalurg.com/images/pages/file/71397210929.pdfIn PDF document text
  • http://hortprotect.canadanursery.com/image/file/46797821372.pdfIn PDF document text
  • http://www.viksexteriors.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613cede00782f---76442245741.pdfIn PDF document text
  • https://dveropolis.ru/upload_picture/34446697598.pdfIn PDF document text
  • https://soudurelauziere.ca/upload/editor/file/48663544006.pdfIn PDF document text
  • https://cafij.co.za/XSRYdR1H?utm_term=articulos+de+caries+en+ni%C3%B1os+pdfPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000598a5.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off000598a5.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.