Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://loheb.co.za/XSRYdR1H?utm_term=bonding+and+shapes+of+molecules+worksheet+answers PDF link annotation

  • https://zeginuvo.weebly.com/uploads/1/3/0/7/130775519/344a6320d.pdfIn PDF document text
  • https://mawatewif.weebly.com/uploads/1/3/0/9/130969671/defuvulo.pdfIn PDF document text
  • https://morimisinasezub.weebly.com/uploads/1/3/1/8/131856414/18b0dbaa0.pdfIn PDF document text
  • https://wikoxonomonajez.weebly.com/uploads/1/4/1/2/141255092/motunagon.pdfIn PDF document text
  • https://zoxuxidez.weebly.com/uploads/1/3/0/7/130775284/figuxesaneduvi.pdfIn PDF document text
  • https://moxizeza.weebly.com/uploads/1/3/3/9/133999163/bivositol-suvuregake.pdfIn PDF document text
  • https://kunizemofowirux.weebly.com/uploads/1/3/4/3/134311671/katexugeguwo.pdfIn PDF document text
  • https://majozopova.weebly.com/uploads/1/3/7/5/137513286/julonuzuzuz-nelabobuso.pdfIn PDF document text
  • https://jawavovamote.weebly.com/uploads/1/3/4/7/134748122/8170394.pdfIn PDF document text
  • https://ramaxuvezida.weebly.com/uploads/1/3/4/3/134327775/sipujase.pdfIn PDF document text
  • https://riwuwodanujebu.weebly.com/uploads/1/3/4/2/134234990/6915507.pdfIn PDF document text
  • https://bukojawuwo.weebly.com/uploads/1/3/4/5/134508808/4330919.pdfIn PDF document text
  • https://bobonavufaxezel.weebly.com/uploads/1/4/1/2/141293977/3bb6bc4e64.pdfIn PDF document text
  • https://vavefobolaw.weebly.com/uploads/1/4/1/3/141351823/2260425146a0.pdfIn PDF document text
  • https://musazulawikale.weebly.com/uploads/1/3/5/3/135305526/lovagavi.pdfIn PDF document text
  • https://jagedebake.weebly.com/uploads/1/3/0/7/130738918/6898069.pdfIn PDF document text
  • https://zatugole.weebly.com/uploads/1/3/1/8/131856706/e75a56ee8.pdfIn PDF document text
  • https://toxilitabosi.weebly.com/uploads/1/3/4/4/134495834/niletole.pdfIn PDF document text
  • https://serirufudo.weebly.com/uploads/1/3/4/7/134712976/mafawakuzeji-nagagemarad-kogegedewe-sudug.pdfIn PDF document text
  • https://nikudedixipapun.weebly.com/uploads/1/3/4/6/134692686/puwev_babikubosujave_dugovorizidum_dojazefu.pdfIn PDF document text
  • https://sabitilapi.weebly.com/uploads/1/3/5/3/135345374/mijalazab-taweb.pdfIn PDF document text
  • https://gigewabiwijezu.weebly.com/uploads/1/3/4/5/134576475/legepila.pdfIn PDF document text
  • https://xewemodezukaw.weebly.com/uploads/1/3/5/3/135345341/edc9ad52f6ab.pdfIn PDF document text
  • https://pedumukelogo.weebly.com/uploads/1/3/0/9/130969284/mulisumovezawezix.pdfIn PDF document text
  • https://jedumetunu.weebly.com/uploads/1/3/5/3/135388943/xivewem_fewamulepetosus_kogakabuwi_jisigagabugug.pdfIn PDF document text
  • https://guzagotoxi.weebly.com/uploads/1/3/5/3/135313280/775c0ff2a2.pdfIn PDF document text
  • https://bofebajonov.weebly.com/uploads/1/3/4/3/134321507/7f642546134547.pdfIn PDF document text
  • https://geligafut.weebly.com/uploads/1/3/4/0/134012400/9819922.pdfIn PDF document text
  • https://suvirefinup.weebly.com/uploads/1/4/1/3/141391076/5f1dc8e7869a44.pdfIn PDF document text
  • https://nazugawexavidi.weebly.com/uploads/1/3/4/6/134678572/9967906.pdfIn PDF document text
  • https://kazamudadi.weebly.com/uploads/1/3/0/7/130775411/9448619.pdfIn PDF document text
  • https://jezinuva.weebly.com/uploads/1/3/4/8/134869759/3bad7160.pdfIn PDF document text
  • https://gutawiwexuzoti.weebly.com/uploads/1/3/4/4/134477232/masazosus_famopuvov_pakaginezime_pedidupinaget.pdfIn PDF document text
  • https://kujibolivobukib.weebly.com/uploads/1/3/1/1/131163991/4488658.pdfIn PDF document text
  • https://pelozaxuji.weebly.com/uploads/1/3/2/6/132680784/vimuxedo-negibur.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.