Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://bilasiparacollege.org/assets/kcfinder/upload/files/11794269032.pdf In PDF document text

  • https://biocoop.legreniervert.fr/ckfinder/userfiles/files/dilabof.pdfIn PDF document text
  • https://majubesar.info/contents/files/8979827932.pdfIn PDF document text
  • http://www.chestheart.org/assets/ckeditor/kcfinder/upload/files/kigeker.pdfIn PDF document text
  • https://chennothinterios.com/uploads/file/4202483637.pdfIn PDF document text
  • http://nccpindia.org/ckeditor/kcfinder/upload/files/4842323210.pdfIn PDF document text
  • http://phantasos.org/userfiles/file/16697314487.pdfIn PDF document text
  • http://cadex.biz/app/webroot/kcfinder/upload/files/38979807971.pdfIn PDF document text
  • http://www.etiquettes-adhesives-bobine.fr/kcfinder/upload/files/98172740776.pdfIn PDF document text
  • http://imi.vc/upload/files/kasop.pdfIn PDF document text
  • http://sns-russia.ru/userfiles/file/88874428173.pdfIn PDF document text
  • http://spodne-pradlo-2bpoint.sk/UserFiles/File/37676877855.pdfIn PDF document text
  • http://gabinetortodontyczny.eu/userfiles/file/98254409736.pdfIn PDF document text
  • https://gresathouse.com/wp-content/plugins/super-forms/uploads/php/files/d56fd4c7b7a7108496cd9b52cac72eee/rorifafaj.pdfIn PDF document text
  • https://conexus-study-abroad-travel.com/ckfinder/userfiles/file/2299124304.pdfIn PDF document text
  • http://www.oloron-ste-marie.fr/Oloron/kcfinder/upload/files/6436015609.pdfIn PDF document text
  • http://ersatzmonitor.de/userfiles/file/pajitezibiseridexabobaj.pdfIn PDF document text
  • http://camwater.org/media/files/4925170345.pdfIn PDF document text
  • https://himalayanwanderer.com/himalayan/userfiles/files/2121239669.pdfIn PDF document text
  • http://ambvetesopo.eu/userfiles/files/41292883180.pdfIn PDF document text
  • https://kmedebiyatgunleri.com/ckfinder/userfiles/files/84984500006.pdfIn PDF document text
  • https://massagetheory.ca/wp-content/plugins/super-forms/uploads/php/files/7d276f7587878cc4a8c3ef8d893593ab/pokasugozegedebowigewak.pdfIn PDF document text
  • http://chinamakina.com/userfiles/file/gafuvadipozaso.pdfIn PDF document text
  • https://vdadanang.vn/app/webroot/assets/files/jokap.pdfIn PDF document text
  • https://gionggiacam.gagiongvitgiong.com/ckfinder/userfiles/files/7031628190.pdfIn PDF document text
  • http://igigeothermal.jp/userfiles/file/90005197940.pdfIn PDF document text
  • https://rodotour.com/userfiles/file/kuzupowuvigopotoluledixi.pdfIn PDF document text
  • http://leadingedgecorporate.com/user_images/file/80432218717.pdfIn PDF document text
  • http://solartgaleria.hu/images/file/94829366389.pdfIn PDF document text
  • http://gdgom.com/upload/file/2203060803224969604bl1zbla5j8p.pdfIn PDF document text
  • https://clubharison.com/userfiles/file/sovulipimit.pdfIn PDF document text
  • http://studiocastigli.eu/userfiles/files/fojizibusaxusiroduragum.pdfIn PDF document text
  • https://floridainvestment.cz/files/file/12347074887.pdfIn PDF document text
  • https://aldaserwis.pl/ckfinder/userfiles/files/16550926992.pdfIn PDF document text
  • https://123natura.com/stockages/files/kozuxuxetexogen.pdfIn PDF document text
  • https://hohsingfiber.com/ufiles/files/94434633880.pdfIn PDF document text
  • https://fecuq.co.za/XSRYdR1H?utm_term=atf+box+setupPDF link annotation
  • http://www.ghidmariaj.ro/app/webroot/files/ckfinder/userfiles/files/78985306697.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0003454e.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0003454e.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.