Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Embedded JS stream low PDF_JS
  PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://podar.co.za/XSRYdR1H?utm_term=apple+pie+recipe PDF link annotation

  • http://handbook.hu/upload/page/file/paluz.pdfIn PDF document text
  • https://lupopuxavenizo.weebly.com/uploads/1/4/1/4/141495803/buzawojozokofivu.pdfIn PDF document text
  • https://tdh-europe.org/files/files/66800692015.pdfIn PDF document text
  • https://lrsdev.com/userfiles/file/39591156423.pdfIn PDF document text
  • https://pt-olympus.com/contents/files/mizofomorevukiz.pdfIn PDF document text
  • https://jijoromosuw.weebly.com/uploads/1/3/4/7/134714512/mefasuwan.pdfIn PDF document text
  • https://boxuvudadutubip.weebly.com/uploads/1/3/2/6/132695546/6284951.pdfIn PDF document text
  • http://investmedic.com/app/webroot/assets/js/kcfinder/upload/files/39939413623.pdfIn PDF document text
  • https://dizorewumuzesab.weebly.com/uploads/1/3/4/0/134012942/zezojukusaroxozoboxu.pdfIn PDF document text
  • http://joinsocialbubble.com/cake/beta/userfiles/file/guguvamejuvitezuri.pdfIn PDF document text
  • http://rosspeed.com/kcfinder/upload/files/68657601125.pdfIn PDF document text
  • https://bafuvigugasud.weebly.com/uploads/1/3/5/3/135308410/mijet_linoxede_pabesugef_kefobimorak.pdfIn PDF document text
  • https://pitulero.weebly.com/uploads/1/3/2/6/132683003/vuwezafotagijug-fupaxopaliwuto-neberulovorejep.pdfIn PDF document text
  • https://sugopubix.weebly.com/uploads/1/3/1/6/131637077/1441168.pdfIn PDF document text
  • https://fibaquitaine.fr/cebatrama/userfiles/files/25445645491.pdfIn PDF document text
  • https://tuwavuko.weebly.com/uploads/1/3/5/3/135394323/6d96be869.pdfIn PDF document text
  • http://vinczeandlaszlo.com/upload/30600476731.pdfIn PDF document text
  • https://sunnybeachaeroclub.com/files/files/bibugorewilobe.pdfIn PDF document text
  • http://salamino.pl/userfiles/file/zufikobuv.pdfIn PDF document text
  • http://usmleworkout.com/files/file/denukolepekabatafofoju.pdfIn PDF document text
  • https://www.reliancecareuk.com/wp-content/plugins/super-forms/uploads/php/files/687b4242b43a202024a61a861f18d3c7/sabesus.pdfIn PDF document text
  • https://bidiguregila.weebly.com/uploads/1/3/4/7/134700143/poxadipopepewef_tazapuganowaxa.pdfIn PDF document text
  • https://foundryindia.org/userfiles/file/pilujipiwafumodigavena.pdfIn PDF document text
  • http://k12kos.com/ckfinder/userfiles/files/44950713751.pdfIn PDF document text
  • https://biwilodumiz.weebly.com/uploads/1/3/4/3/134319983/kivopifolajedon.pdfIn PDF document text
  • https://xuvunigito.weebly.com/uploads/1/3/1/1/131164310/ad092.pdfIn PDF document text
  • http://jor-agric-aqua.com/user_img/files/nowijetosugozevex.pdfIn PDF document text
  • http://mojahotels.com/ckfinder/userfiles/files/9582210589.pdfIn PDF document text
  • https://thermaltrailrace.com/imagini_ws/43847162968.pdfIn PDF document text
  • http://hataylezzeti.com/resimler/files/pizafajiropiza.pdfIn PDF document text
  • https://www.verimevzabavu.cz/ckfinder/userfiles/files/6164939180.pdfIn PDF document text
  • https://www.mtiwelding.co.uk/admin/ckfinder/userfiles/files/radosidukunawigupubozedaj.pdfIn PDF document text
  • http://dispensapertutti.com/userfiles/files/nadijesatetezelezaxuginef.pdfIn PDF document text
  • https://santa.sg/images/users/00000000/files/kuvurimore.pdfIn PDF document text
  • https://probidjp.com/ckfinder/userfiles/files/20220321_164643.pdfIn PDF document text
  • http://studiotecnicodambra.eu/userfiles/files/86819545813.pdfIn PDF document text
  • https://www.pkkmaluku.org/berkas/plugin/ckeditor/kcfinder/upload/files/92979757849.pdfIn PDF document text
  • https://terunutu.weebly.com/uploads/1/3/5/3/135319236/pedaza.pdfIn PDF document text
  • https://tarajusozu.weebly.com/uploads/1/4/1/3/141337870/2432541.pdfIn PDF document text
  • http://kientrucnhacuagio.com/upload/files/zosisotusewisi.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.