Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://fecuq.co.za/XSRYdR1H?utm_term=potential+transformer+burden+rating PDF link annotation

  • http://polenes.cl/userfiles/file/7428532829.pdfIn PDF document text
  • http://toyotarent.hk/FileData/ckfinder/files/20220306_005F1387E3BD308B.pdfIn PDF document text
  • http://waycreon.net/bhaskar/yii/upload/files/36634870876.pdfIn PDF document text
  • https://mi-stores.com/basketballtotaal/images/editor/file/79359927586.pdfIn PDF document text
  • https://sssmri.com/ckfinder/userfiles/files/latagamejep.pdfIn PDF document text
  • http://xzavod.com/kcfinder/upload/files/bosajuropapaxomalovoporu.pdfIn PDF document text
  • https://marupyara.com/fotos/userfiles/file/sowipinufilubonasomix.pdfIn PDF document text
  • https://ce-mi.pl/uploads/userfiles/files/bavababunapapawupizal.pdfIn PDF document text
  • http://www.mgamk.ru/ckeditor/kcfinder/upload/files/60580004101.pdfIn PDF document text
  • https://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/16213f66094cce---21321799586.pdfIn PDF document text
  • http://moto-bike.pl/userfiles/file/ridesijugep.pdfIn PDF document text
  • http://jrecchina.com/ckeditor/ckfinder/userfiles/files/84273169821.pdfIn PDF document text
  • https://alenakovalchuk.ru/wp-content/plugins/super-forms/uploads/php/files/db76c630aec62a6e748ef05851538750/67165929594.pdfIn PDF document text
  • https://sasalidayanisma.org/uploads/file/20529878842.pdfIn PDF document text
  • http://akwarella.pl/user_uploads/file/bitetiseta.pdfIn PDF document text
  • http://tamtamphat.com/upload/files/35832965427.pdfIn PDF document text
  • https://upsoul.com.br/assets/kcfinder/upload/files/69421291325.pdfIn PDF document text
  • http://qlionshousing.ca/images/fck/file/97108964702.pdfIn PDF document text
  • https://steyr-mannlicher.hu/admin/kcfinder/upload/files/75563367631.pdfIn PDF document text
  • http://mot-a-mot.fr/kcfinder/upload/files/31494578725.pdfIn PDF document text
  • http://fskyok.com/uploadfile/files/5128329192.pdfIn PDF document text
  • https://biserica-izvorul-tamaduirii.ro/files/80742179357.pdfIn PDF document text
  • https://butterfly-propertymanagement.com/userfiles/file/38358025845.pdfIn PDF document text
  • http://kochi-east-rc.com/admin/kcfinder/upload/files/75057436948.pdfIn PDF document text
  • http://ceemafor.com/catalogue/upload/document/12668246831.pdfIn PDF document text
  • http://lnhaihui.com/userfiles/file/20220303025048_437774683.pdfIn PDF document text
  • http://hcstonetw.com/uploads/files/202202281747235630.pdfIn PDF document text
  • http://chestheart.org/assets/ckeditor/kcfinder/upload/files/kejonenopoliso.pdfIn PDF document text
  • http://hide-bo.com/img/tmp/file/58961316738.pdfIn PDF document text
  • https://inmasa.com/imatges/file/85109223154.pdfIn PDF document text
  • http://influences-vegetales.eu/assets/Image/files/letadujisupupepiwironi.pdfIn PDF document text
  • https://safecampus.in/cmsCart/upload/file/bureladipureboxotokaj.pdfIn PDF document text
  • http://wideanglepackaging.com/ckfinder/userfiles/files/nalemi.pdfIn PDF document text
  • http://visualpaint.com/wp-content/plugins/formcraft/file-upload/server/content/files/16213c47077548---xivewopab.pdfIn PDF document text
  • http://willajarmar.pl/userfiles/file/16972601318.pdfIn PDF document text
  • https://www.kazaviaspas.kz/app/webroot/js/kcfinder/upload/files/vidig.pdfIn PDF document text
  • http://bckbytow.naszbip.pl/img/upload/files/55439216085.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000577dd.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off000577dd.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.