Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Travel-support phone-number stuffing scam high SE_TRAVEL_SUPPORT_PHONE_SCAM
  Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://cctraff.ru/123?utm_term=orangetheory+cancellation+policy+waitlist In PDF document text

  • https://vesasasafej.weebly.com/uploads/1/3/4/7/134758359/fobekeratisamebedu.pdfIn PDF document text
  • https://liziruji.weebly.com/uploads/1/3/4/3/134380663/9097827.pdfIn PDF document text
  • https://polabufasol.weebly.com/uploads/1/3/2/8/132814050/saxibafu.pdfIn PDF document text
  • https://zirodaxe.weebly.com/uploads/1/3/4/6/134611642/7386109.pdfIn PDF document text
  • http://www.ascendercorp.com/In extracted file (font_00_sfnt_off0000d7f8.bin)
  • http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off0000d7f8.bin)
  • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe1cfe3570fb44d1cbc93a/1606294783956/52057402173.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/88f6bc25-8e3b-420a-8066-d95ee1088803/buluwojopi.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b9d40026-b2f6-4524-bc1a-4396589eb7b8/kogev.pdfIn PDF document text
  • https://static1.squarespace.com/static/5fc0e46f24b06a7eb3ff1788/t/5fc2b4fc5147b148048bb977/1606595836946/olive_kitteridge_libro.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/92a209f5-9a0e-4093-805f-a44c9b1801be/ecuador_vs_uruguay_en_vivo_copa_america.pdfIn PDF document text
  • https://static1.squarespace.com/static/5fc50ec912facd59cec7ad64/t/5fd613d2154d727871e26d49/1607865299610/android_fragment_databinding_viewmodel.pdfIn PDF document text
  • https://static1.squarespace.com/static/5fcea56b7e980a32d6872967/t/5fd017335ec17a4c6684424b/1607472948574/ninja_sticker_online.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/04e37ffa-0a07-4978-9601-3ae25cbfc98a/roll_of_thunder.pdfIn PDF document text
  • https://static1.squarespace.com/static/5fc19a8f40f1034a5caddecf/t/5fcf72d00496d067bdd3dcc9/1607430864329/gun_war_battleground_survival_shooter_3ds.pdfIn PDF document text
  • https://static1.squarespace.com/static/5fc0e2ed17e7202640ea1bf0/t/5fc5190a9ee0f32b87f5b1d2/1606752522636/reliable_property_services.pdfIn PDF document text
  • https://static1.squarespace.com/static/5fc57727ab79f442f2485e4b/t/5fcd04a72bc7884852b8131b/1607271591839/do_zombies_drop_iron_ingots_in_minecraft.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/976110c2-f0db-4713-b52b-09b94e6d8a09/vokenox.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off0000d7f8.bin)
  • http://dejavu.sourceforge.netIn extracted file (font_03_sfnt_off00012f14.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_03_sfnt_off00012f14.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.