Malicious PDF — malware analysis report

Heuristics 5

• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Embedded JS stream low PDF_JS
  PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://colod.co.za/XSRYdR1H?utm_term=manual+wheelchair+sizes+width+length+width PDF link annotation

  • https://havadisname.com/upload/ckfinder/files/xovara.pdfIn PDF document text
  • https://www.kossuth-csepel.hu/inc/kcfinder/upload/files/56264081244.pdfIn PDF document text
  • https://sipare.com.ar/wp-content/plugins/super-forms/uploads/php/files/nfhd8sg201svm1103t3c68lkjd/27909712447.pdfIn PDF document text
  • https://kuwuwapapo.weebly.com/uploads/1/4/2/0/142009302/meseliviwidi.pdfIn PDF document text
  • http://szyoujin.com/UploadFile/file/20220620133046092.pdfIn PDF document text
  • http://ucinnovation.ru/admin/ckfinder/userfiles/files/woliluzabu.pdfIn PDF document text
  • https://pigoresaj.weebly.com/uploads/1/3/4/5/134589591/813c7555db56.pdfIn PDF document text
  • http://chip-chup.hu/upload/file/kufigavajagotigil.pdfIn PDF document text
  • https://sosuxivi.weebly.com/uploads/1/3/6/0/136056733/vujajobinog_nepeta_loxul.pdfIn PDF document text
  • https://fufifodex.weebly.com/uploads/1/3/2/8/132814348/6985.pdfIn PDF document text
  • https://aletihad-group.com/userfiles/files/sedisanumebaku.pdfIn PDF document text
  • https://full-e.com/app/webroot/userfiles/files/20220427_081757.pdfIn PDF document text
  • https://www.benkorner.nl/admin/library/ckfinder/userfiles/files/36979948762.pdfIn PDF document text
  • https://polosaguri.weebly.com/uploads/1/4/1/4/141415529/gudominitipugoj-lurobebimema.pdfIn PDF document text
  • http://iaestedresden.de/userfiles/file/xufukudemexisanofer.pdfIn PDF document text
  • https://surolutavojujum.weebly.com/uploads/1/4/1/3/141331285/1d8f5cb2ef.pdfIn PDF document text
  • https://www.aatae.pt/backoffice/assets/js/kcfinder/upload/files/50017037570.pdfIn PDF document text
  • https://greassi.com/editor_upload/file/22068807846.pdfIn PDF document text
  • https://tonipemaxux.weebly.com/uploads/1/4/1/8/141857845/zawoxidefuxa.pdfIn PDF document text
  • http://amis-simserhof.fr/kcfinder/upload/files/18649800767.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62bb901038653525db6156eb/1656459280826/rugiruta.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62ba9be4af22da1d08b86473/1656396773170/35357210880.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62bab53a49753a546567496e/1656403259101/rinesa.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62be4f849df3ae5a72e0fcbe/1656639364927/sexenigejipipesujaluk.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62b72bb1dc7c895918dce502/1656171441902/fufuweroxelobudiwi.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62b691c6072bf9379e4a929d/1656132038663/54851460366.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62b4a0a785a60b1b0b2ce098/1656004776057/7909235800.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62b69582463bd30770b5733b/1656132995034/how_to_calculate_critical_ratio.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62ba5d9e0b521a782a8f648d/1656380831394/small_parts_inc_amazon.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62b5bd0098b7461fe4f05313/1656077569321/it_disaster_recovery_test_plan_template.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.