Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Embedded JS stream low PDF_JS
  PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://yubit.co.za/XSRYdR1H?utm_term=compendium+on+ertms+pdf PDF link annotation

  • http://chulatutoracademy.com/chulatutor/ckfinder/userfiles/files/50994661286.pdfIn PDF document text
  • http://buafit.bg/Uploads/files/80630675772.pdfIn PDF document text
  • https://supportsurgical.com.br/assets/kcfinder/upload/files/63888142782.pdfIn PDF document text
  • http://sportsbettingconsultants.net/cote_dor_import/admin/ckfinder/userfiles/files/66536271915.pdfIn PDF document text
  • http://ne-moloko.ee/wp-content/plugins/super-forms/uploads/php/files/44cbaf5d0728c1198e38314a54b9739f/72237730319.pdfIn PDF document text
  • http://blekinge.boj.se/uploads/userfiles/files/fowuvaragodiwaxu.pdfIn PDF document text
  • http://kerrya.com/ckfinder/userfiles/files/46825462676.pdfIn PDF document text
  • http://siriussiramatik.com/panel/kcfinder/upload/files/mutuzumagog.pdfIn PDF document text
  • http://joinsocialbubble.com/cake/beta/userfiles/file/vunevidapezu.pdfIn PDF document text
  • http://maxgear.cz/webpagebuilder/ckfinder/userfiles/files/38507787378.pdfIn PDF document text
  • http://agavietnam.com/img/files/82887118629.pdfIn PDF document text
  • http://hvnepal.com/assets/kcfinder/upload/files/furidapotaremubazufewop.pdfIn PDF document text
  • https://www.ttmagazin.com/assets/admin/js/plugins/kcfinder/upload/files/fubibifapenobugalexuso.pdfIn PDF document text
  • http://imobilestore.de/userfiles/file/56780594656.pdfIn PDF document text
  • https://metagrhyd.com/infopub/pub/file/jegerejatubuvej.pdfIn PDF document text
  • http://luatsubienhoa.com/upload/ck/files/bezemigitovizorikawotate.pdfIn PDF document text
  • http://jobcred.com/rk/jobcred/uploads/image/file/56715426801.pdfIn PDF document text
  • https://pikhospital.com/ck_uploads/uploads/files/duminidu.pdfIn PDF document text
  • http://hpworld.hu/data/pic/Image/file/64691516398.pdfIn PDF document text
  • http://studioesflores.pl/obrazy/file/78838029315.pdfIn PDF document text
  • http://cissi.it/userfiles/files/25116803870.pdfIn PDF document text
  • http://pebyte.com/wp-content/plugins/super-forms/uploads/php/files/09ekb29fatt558uoa0l12pjao9/57635838781.pdfIn PDF document text
  • http://nawoo.net/userData/board/file/kotikifato.pdfIn PDF document text
  • http://boldogelet.hu/media/goragiruzivuvariv.pdfIn PDF document text
  • http://strandkrabbe-hohenfelde.de/sites/default/files/files/zamisubafasilisu.pdfIn PDF document text
  • https://laval.gatr.ca/img/etablissements/files/85811240222.pdfIn PDF document text
  • http://universalthailand.com/images/uploads/ckfinder/files/nizotedilimuv.pdfIn PDF document text
  • https://limsurdua.com/contents/files/devuserebidoda.pdfIn PDF document text
  • http://ekonopuntos.com/campannas/file/15591795842.pdfIn PDF document text
  • http://hoogbegaafdennu.nl/userfiles/file/57489827192.pdfIn PDF document text
  • http://bn-biz.com/userData/board/file/xofaruf.pdfIn PDF document text
  • https://afanasyev-design.ru/wp-content/plugins/super-forms/uploads/php/files/ae176db3bfd8df36f8e76dc9931a1ee3/sobofowa.pdfIn PDF document text
  • http://mynigaoe.com/upload/file/20220325152226.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.