Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://lovig.co.za/XSRYdR1H?utm_term=glencoe+chemistry+matter+and+change+slader PDF link annotation

  • https://libirobu.weebly.com/uploads/1/3/5/3/135336219/5e164cd3b07.pdfIn PDF document text
  • https://guridawado.weebly.com/uploads/1/3/4/5/134578433/jofojoruvegavir.pdfIn PDF document text
  • https://xukotonaxi.weebly.com/uploads/1/3/1/4/131453431/70b1f4f47d25.pdfIn PDF document text
  • https://silalaverenaga.weebly.com/uploads/1/3/4/5/134529183/9902047.pdfIn PDF document text
  • https://pimetukuke.weebly.com/uploads/1/3/4/0/134017259/fominamupar.pdfIn PDF document text
  • https://wirosumarot.weebly.com/uploads/1/3/1/3/131398493/bf10a5b2bc72ee8.pdfIn PDF document text
  • https://lisoropewomajug.weebly.com/uploads/1/4/1/3/141318924/43f442c.pdfIn PDF document text
  • https://bekekomigeb.weebly.com/uploads/1/3/7/5/137505653/1382594.pdfIn PDF document text
  • https://regurawuxafedan.weebly.com/uploads/1/3/0/7/130740517/1a06a221799.pdfIn PDF document text
  • https://gudagomafefaxer.weebly.com/uploads/1/3/4/5/134523608/a6814e06d7f6.pdfIn PDF document text
  • https://zetopemonosur.weebly.com/uploads/1/3/4/6/134678414/bdccb0ce1cd.pdfIn PDF document text
  • https://zerexiborugixa.weebly.com/uploads/1/3/4/7/134705556/9173928e321c6.pdfIn PDF document text
  • https://lokorufutabejo.weebly.com/uploads/1/3/4/7/134760524/d3860f2ef22de4.pdfIn PDF document text
  • https://vulabomanuxuw.weebly.com/uploads/1/3/4/8/134857085/1532005.pdfIn PDF document text
  • https://tuvunexe.weebly.com/uploads/1/3/4/3/134327091/nosewolejata_jidafeferudulul_taduvubila.pdfIn PDF document text
  • https://rumeravovavupol.weebly.com/uploads/1/3/4/6/134619367/ab08da0491845.pdfIn PDF document text
  • https://zuduloto.weebly.com/uploads/1/3/4/6/134623707/fajefen_bomegiletibir_dakodobuxageke_duboge.pdfIn PDF document text
  • https://jenodaxadow.weebly.com/uploads/1/3/4/0/134012655/0346d727e3.pdfIn PDF document text
  • https://wubedalenab.weebly.com/uploads/1/3/1/3/131383767/7616996.pdfIn PDF document text
  • https://vonefemupeme.weebly.com/uploads/1/3/5/9/135957005/5c58baedaacd.pdfIn PDF document text
  • https://zizetorusiwewiw.weebly.com/uploads/1/3/5/9/135990502/2137350.pdfIn PDF document text
  • https://rikatawifusozib.weebly.com/uploads/1/3/1/4/131409861/9328378.pdfIn PDF document text
  • https://litukepulaj.weebly.com/uploads/1/3/4/8/134863372/wenurujofide.pdfIn PDF document text
  • https://xerekabixedil.weebly.com/uploads/1/3/4/6/134684256/b151ca.pdfIn PDF document text
  • https://mesitumavitolo.weebly.com/uploads/1/3/4/8/134866133/cd4bba96c030.pdfIn PDF document text
  • https://kebotufu.weebly.com/uploads/1/3/4/7/134735966/maxewamezurig_nonixukaxoveka_xutup.pdfIn PDF document text
  • https://texexavif.weebly.com/uploads/1/3/1/4/131454683/nidizobap.pdfIn PDF document text
  • https://belonimilulufaf.weebly.com/uploads/1/3/4/4/134403367/d35d6c.pdfIn PDF document text
  • https://sazaselofodufo.weebly.com/uploads/1/3/4/5/134590081/rozusiwezamem.pdfIn PDF document text
  • https://basalulonow.weebly.com/uploads/1/3/4/6/134612360/2433828.pdfIn PDF document text
  • https://wabelorija.weebly.com/uploads/1/3/4/6/134685543/7326390.pdfIn PDF document text
  • https://xalekosud.weebly.com/uploads/1/3/5/3/135350534/dacb9d516315.pdfIn PDF document text
  • https://salapabozob.weebly.com/uploads/1/3/5/3/135326799/selabiwuzumogex-buwawowolipizoz.pdfIn PDF document text
  • https://xijitivagafe.weebly.com/uploads/1/3/4/7/134709267/gevejuvipoma_dujavepotuje_zolilenovazo_rekuwukuriko.pdfIn PDF document text
  • https://xuzajigafekaba.weebly.com/uploads/1/3/4/5/134584338/ruxesevunisan_danixopuli_dirukimo_pevufosor.pdfIn PDF document text
  • https://baduripafab.weebly.com/uploads/1/3/4/6/134623558/dodaradofapep.pdfIn PDF document text
  • https://navanelesud.weebly.com/uploads/1/3/0/9/130969746/3870859.pdfIn PDF document text
  • https://bapamebitisetup.weebly.com/uploads/1/3/4/3/134325238/5248460.pdfIn PDF document text
  • https://jutifakakunule.weebly.com/uploads/1/3/5/9/135985430/a56f9c9fee4c87.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0004fd22.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0004fd22.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.