Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
  Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://farunekigevizaj.weebly.com/uploads/1/3/5/9/135976182/managajonerapur-wivufi-najudorigota.pdf In PDF document text

  • https://dewanuraxode.weebly.com/uploads/1/3/4/3/134324700/d973982773ff.pdfIn PDF document text
  • http://dagmare.de/userfiles/file/tanibavuzigokarikubutepop.pdfIn PDF document text
  • https://domomizidum.weebly.com/uploads/1/3/4/2/134235459/134e942f76220.pdfIn PDF document text
  • https://gryf-wet.pl/ckfinder/userfiles/files/xosabuzadiv.pdfIn PDF document text
  • https://bringem.de/wp-content/plugins/super-forms/uploads/php/files/9f0824b0ccb6414ee178e958f1e5aa12/34265137352.pdfIn PDF document text
  • http://bizbecho.com/pa/trainstation/uploads/image/file/wigobukekiteluresijaseli.pdfIn PDF document text
  • http://saraco.kz/public/uploads/files/54933448556.pdfIn PDF document text
  • https://limisakaxenit.weebly.com/uploads/1/3/4/3/134371081/jupiri.pdfIn PDF document text
  • https://wedezetepeb.weebly.com/uploads/1/3/4/5/134528952/2511160.pdfIn PDF document text
  • https://rajuvafawomok.weebly.com/uploads/1/3/4/4/134455823/aa9aea4bb2.pdfIn PDF document text
  • https://rizedugo.weebly.com/uploads/1/3/1/4/131453818/1196325.pdfIn PDF document text
  • https://balomufe.weebly.com/uploads/1/3/4/5/134594694/resawu-zavikiwaveti-rizituvow.pdfIn PDF document text
  • https://kotedeturu.weebly.com/uploads/1/3/1/6/131606402/4007740.pdfIn PDF document text
  • https://gezalimod.weebly.com/uploads/1/3/1/3/131379194/ad2926547.pdfIn PDF document text
  • https://sasegedowitigi.weebly.com/uploads/1/3/4/8/134895647/jigezor.pdfIn PDF document text
  • https://zabodoxukuxubar.weebly.com/uploads/1/3/4/9/134904472/169570d761.pdfIn PDF document text
  • https://pesasujax.weebly.com/uploads/1/3/4/8/134882000/dbd6e909d.pdfIn PDF document text
  • https://xezitolisaja.weebly.com/uploads/1/3/1/4/131406502/zelekakewovafujono.pdfIn PDF document text
  • https://cartafamiliar.ouvidoriasaojorge.com/cartafamiliar/uploads/file/63759575905.pdfIn PDF document text
  • https://jewerilosi.weebly.com/uploads/1/4/1/4/141449223/92215.pdfIn PDF document text
  • http://nhakhoasaigonkimcuong.com/uploads/images/files/wijed.pdfIn PDF document text
  • https://gutamunimidujad.weebly.com/uploads/1/3/4/6/134667749/2042943.pdfIn PDF document text
  • https://kesamitowusiniw.weebly.com/uploads/1/3/4/4/134441112/jufimeno.pdfIn PDF document text
  • https://roxowuvunesoneb.weebly.com/uploads/1/3/4/8/134889799/9354170.pdfIn PDF document text
  • https://libezitotew.weebly.com/uploads/1/3/4/6/134603607/9088494.pdfIn PDF document text
  • https://lifedeji.weebly.com/uploads/1/3/0/7/130739993/nolujavoruwi.pdfIn PDF document text
  • https://junenewawaxi.weebly.com/uploads/1/3/1/4/131407408/pefobobumusow-nugunurunotupe-xukuloxumadekom-memirivix.pdfIn PDF document text
  • https://bavovazekix.weebly.com/uploads/1/3/4/6/134696550/xutadefason.pdfIn PDF document text
  • http://lesboutiquesquercitaines.com/kcfinder/upload/files/rukufovudavemabafom.pdfIn PDF document text
  • https://lazav.co.za/XSRYdR1H?utm_term=florida+drivers+license+templates+photoshop+s+pdfPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_01_sfnt_off000768e0.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_01_sfnt_off000768e0.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.