Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Embedded JS stream low PDF_JS
  PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
• SEO-redirector lure link (multi-word utm_term) low PDF_SEO_UTM_REDIRECTOR_LINK
  PDF contains a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the search-keyword gateway used by the 'free document download' phishing family. Surfaced as an IOC; on its own this is a low-confidence signal.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://lovig.co.za/XSRYdR1H?utm_term=whatsapp+video++2018+odia PDF link annotation

  • http://hzzxtl.com/UploadFile/file/20220215095332193.pdfIn PDF document text
  • http://bazoolwddd.specialty-match.com/upload/files/nazimetuzolukolomuromiza.pdfIn PDF document text
  • http://panel2conso.com/userfiles/file/3927067875.pdfIn PDF document text
  • http://homeopathyhongkong.org/files/sifofuguruxisavonit.pdfIn PDF document text
  • http://md-servicios.com/userfiles/file/75540296431.pdfIn PDF document text
  • http://www.nstrechy.cz/upload/files/76501183138.pdfIn PDF document text
  • http://idolyokocho.com/js/ckfinder/userfiles/files/59881656964.pdfIn PDF document text
  • https://qcbusa.barettis.com/userfiles/file/bisenud.pdfIn PDF document text
  • http://hotelparkplaza.in/app/webroot/js/kcfinder/upload/files/30508033209.pdfIn PDF document text
  • http://emeraldcovepartners.com/_data/images/file/2216220621.pdfIn PDF document text
  • http://synergienetwork.net/userfiles/file/samudodesosa.pdfIn PDF document text
  • http://yey.uw52.com/upload/files/lexefefadadosafad.pdfIn PDF document text
  • http://uhy-th.com/image/upload/files/zobagorezezevefijebilaved.pdfIn PDF document text
  • https://mdteam.se/ckfinder/userfiles/files/70358052542.pdfIn PDF document text
  • http://hurtowniagrafit.pl/userfiles/file/78911819962.pdfIn PDF document text
  • https://calprin.com/ckfinder/userfiles/files/zarovunanezamerubimapapuw.pdfIn PDF document text
  • https://webseitenvergleich.com/newerac2c/userfiles/file/gidaroji.pdfIn PDF document text
  • http://lifecare4all.com/upload/files/18714085114.pdfIn PDF document text
  • http://milkexim.ru/imgeditor/file/jefeposoguxo.pdfIn PDF document text
  • https://raljob.com/userfiles/file/nojuragodami.pdfIn PDF document text
  • http://mail.teleserviciomalaga.com/ckfinder/userfiles/files/58107515849.pdfIn PDF document text
  • http://zmksk.ru/userfiles/file/nozixejabaliwegugazibuni.pdfIn PDF document text
  • http://inlocoodontologia.com.br/assets/kcfinder/upload/files/tisigubar.pdfIn PDF document text
  • https://aicpwdosaeast.com/ckfinder/userfiles/files/34191250169.pdfIn PDF document text
  • https://trickapotisk.cz/webpagebuilder/ckfinder/userfiles/files/50094178405.pdfIn PDF document text
  • http://branonperformance.com/ckfinder/userfiles/files/62687675591.pdfIn PDF document text
  • https://bkr.jetdesign.pl/files/files/kazomegutuk.pdfIn PDF document text
  • http://kasargod.net/uploads/file/14010691699.pdfIn PDF document text
  • https://lostfoundglobal.com/userfiles/file/80882703928.pdfIn PDF document text
  • http://asv-solnice.cz/_files/file/31188435159.pdfIn PDF document text
  • http://unilam.eu/user_files/files/delodabitaje.pdfIn PDF document text
  • https://g-ortho.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1620342ada0435---xorujajoguxete.pdfIn PDF document text
  • http://www.szinespillanat.hu/admin/ckeditor/kcfinder/upload/files/97505378400.pdfIn PDF document text
  • https://verdadeon.com.br/kcfinder/upload/files/rowadafon.pdfIn PDF document text
  • http://shinies.ru/img/lib/file/nekixejedonavaweg.pdfIn PDF document text
  • https://share.linkilike.com/libraries/kcfinder/upload/files/vesagajivulexesudese.pdfIn PDF document text
  • http://joshuadacosta.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621ff3fa0f67c---58994706170.pdfIn PDF document text
  • https://xeroxexpres.cz/userfiles/file/jiwivenuzoduxumivigemud.pdfIn PDF document text
  • https://studybrilliant.online/app/webroot/img/userfiles/file/80795886252.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.