Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Embedded JS stream low PDF_JS
  PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://tevav.co.za/XSRYdR1H?utm_term=propiedades+de+%C3%A1ngulos+formados+entre+rectas+paralelas PDF link annotation

  • https://fosogizubosa.weebly.com/uploads/1/3/1/6/131637108/madivevibi.pdfIn PDF document text
  • https://pekavodasusoku.weebly.com/uploads/1/3/5/9/135982803/nubijufulali_mameki.pdfIn PDF document text
  • https://vizumijolotetip.weebly.com/uploads/1/3/5/3/135394273/f537c.pdfIn PDF document text
  • http://usneseni.eu/foto/image/files/1287425603.pdfIn PDF document text
  • https://nozubewow.weebly.com/uploads/1/3/1/1/131164313/takitorewibi.pdfIn PDF document text
  • https://shturnev.com/files/foFKED/file/80818642085.pdfIn PDF document text
  • http://corising.info/sa_upload/userfiles/file/20220204001043.pdfIn PDF document text
  • http://bctlorraine.org/userfiles/file/ganujetire.pdfIn PDF document text
  • https://tabikanopik.weebly.com/uploads/1/3/4/7/134705808/rorumus_xopafu_jegoxi_kajazul.pdfIn PDF document text
  • https://propbrains.com/wp-content/plugins/super-forms/uploads/php/files/589636bd9eb6240f9d98f6a1e4938656/midozi.pdfIn PDF document text
  • https://gedijidejejew.weebly.com/uploads/1/3/0/7/130775336/kerafabagun.pdfIn PDF document text
  • https://cupanghitam.com/contents/files/letisaxulowefumomofabu.pdfIn PDF document text
  • http://salman-group.com/userfiles/file/87811977478.pdfIn PDF document text
  • https://rurajutudap.weebly.com/uploads/1/3/1/4/131437622/xilal.pdfIn PDF document text
  • http://celox-st.hr/sites/default/files/fck/file/ludadojavitasagazupeb.pdfIn PDF document text
  • https://xuvamifete.weebly.com/uploads/1/3/0/8/130874567/1669084.pdfIn PDF document text
  • https://www.adler-leitishofen.de/wp-content/plugins/formcraft/file-upload/server/content/files/1620c601de1f19---57267134469.pdfIn PDF document text
  • http://lizhechem.com/upload/files/87752168851.pdfIn PDF document text
  • https://cbolean.com/wp-content/plugins/super-forms/uploads/php/files/3529e5af256262f0511db879d9cb59c2/64945877033.pdfIn PDF document text
  • https://www.naabelectric.com/userfiles/files/tofoguzuxilez.pdfIn PDF document text
  • http://ets-sptk.ru/pic/file/75704523497.pdfIn PDF document text
  • https://nnkcreations.com/userfiles/file/getufapiresu.pdfIn PDF document text
  • https://pejivepomut.weebly.com/uploads/1/3/5/3/135339444/rovetinejusameb.pdfIn PDF document text
  • https://supogukifululeb.weebly.com/uploads/1/3/4/3/134307834/fenaxasasadibu.pdfIn PDF document text
  • https://armature.ir/cache/fck_files/file/sidudoxutazeri.pdfIn PDF document text
  • http://n3ss.ro/ckfinder/userfiles/files/vutozeriwarigek.pdfIn PDF document text
  • https://wugaxaxelapuwu.weebly.com/uploads/1/3/4/5/134595152/koridig.pdfIn PDF document text
  • https://graviroz.hu/ckfinder/userfiles/files/89014189089.pdfIn PDF document text
  • http://xn--42-6kcdlkbomh7beggito5p.xn--p1ai/userfiles/file/nuxepavubofipikulojexap.pdfIn PDF document text
  • https://archguruorg.welkinovation.com/admin/UserFiles/images/files/24698282644.pdfIn PDF document text
  • http://1111.morefriendship.com/upload/files/46963594947.pdfIn PDF document text
  • http://kidilangues.fr/js/kcfinder/upload/files/43399439053.pdfIn PDF document text
  • https://dev-intranet.publiticket.fr/intranet/upload_fckeditor/file/ruguvokeritedutamuwop.pdfIn PDF document text
  • http://azv-goldeneaue-uthleben.de/kcfinder/upload/files/dilubidigukatebakerura.pdfIn PDF document text
  • http://noahsmarinesurveyors.ca/userfiles/file/72086104302.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netReferenced by PDF JavaScript
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseReferenced by PDF JavaScript

Open this report in the interactive analyzer, or submit your own file for analysis.