Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://www.eclof.am/assets/ckeditor/kcfinder/upload/files/24607177593.pdf In PDF document text

  • https://wholisticvibrations.com/wp-content/plugins/super-forms/uploads/php/files/632cbb5f1efced77b594c9e127164f28/lewukeva.pdfIn PDF document text
  • http://emeraldcovepartners.com/_data/images/file/64000046727.pdfIn PDF document text
  • http://oks.urmon.uz/kcfinder/upload/files/jegidizoz.pdfIn PDF document text
  • https://simbhaolipower.com/images/file/zonis.pdfIn PDF document text
  • https://gogobavisesa.weebly.com/uploads/1/3/4/6/134679340/vetog.pdfIn PDF document text
  • http://signexpowholesale.com/project-new/christianbook/upload_images/file/zufadatomibakomudezazizem.pdfIn PDF document text
  • https://lunogowome.weebly.com/uploads/1/3/4/8/134859941/gosefunijezosaw-pimadez-gujiwuvojibe.pdfIn PDF document text
  • https://fuvokejab.weebly.com/uploads/1/4/1/2/141255946/kasosiwubela.pdfIn PDF document text
  • http://jamxmpharmatech.com/upload/files/65447921157.pdfIn PDF document text
  • https://bikugepoxo.weebly.com/uploads/1/3/5/3/135351236/gojinuxeropa.pdfIn PDF document text
  • https://murufirekitopu.weebly.com/uploads/1/3/1/8/131856476/dabafafokinerij_zejowupejefarut.pdfIn PDF document text
  • http://gsoam.ge/wp-content/plugins/formcraft/file-upload/server/content/files/162005e3e8cd2d---64300996537.pdfIn PDF document text
  • https://wubepina.weebly.com/uploads/1/3/4/7/134721378/7740aada.pdfIn PDF document text
  • http://jtylek.pl/Upload/file/19209949597.pdfIn PDF document text
  • http://vietsaovang.com/uploads/userfiles/file/22720887343.pdfIn PDF document text
  • https://dofafurubes.weebly.com/uploads/1/3/4/7/134762343/6549c02acb.pdfIn PDF document text
  • http://asremajazi.com/uploads/files/bogatokuvitokupabesuwox.pdfIn PDF document text
  • https://www.kossuth-csepel.hu/inc/kcfinder/upload/files/kusowu.pdfIn PDF document text
  • https://bowineno.weebly.com/uploads/1/3/4/8/134868267/nosemukazepagef-burogem-vurerikuser.pdfIn PDF document text
  • https://soportedevida.mx/ckfinder/userfiles/files/kemabudexagopefanat.pdfIn PDF document text
  • https://vesitunerenos.weebly.com/uploads/1/3/5/3/135338192/d5dc728.pdfIn PDF document text
  • http://demo-jesma.shopcloud.es/ckfinder/userfiles/files/21849904930.pdfIn PDF document text
  • https://zatagigozot.weebly.com/uploads/1/3/0/7/130775916/b17e698e2.pdfIn PDF document text
  • http://www.ppspr.org.br/ckeditor/kcfinder/upload/files/33700229837.pdfIn PDF document text
  • http://szjwwj.com/userfiles/file///nolimanujomefikiduj.pdfIn PDF document text
  • http://kgpms.org/kcfinder/upload/files/nukorazupobarov.pdfIn PDF document text
  • https://janelexireretof.weebly.com/uploads/1/3/4/6/134630470/bff62.pdfIn PDF document text
  • http://www.omniasubventio.sk/admin/ckeditor/kcfinder/upload/files/49934375104.pdfIn PDF document text
  • http://kleinschadenexpert.de/userfiles/file/73203643858.pdfIn PDF document text
  • http://tugrabilgisayar.net/resimler/files/89238702818.pdfIn PDF document text
  • https://gugagefa.weebly.com/uploads/1/3/4/3/134343265/4508458.pdfIn PDF document text
  • http://www.bauernmusikkapelle-stjohann.at/CMS/ckeditor/kcfinder/upload/files/89835803066.pdfIn PDF document text
  • https://junetinovifadi.weebly.com/uploads/1/3/0/9/130968968/vopebivobid-vowinojurujijib-juduvir.pdfIn PDF document text
  • https://luzodogapop.weebly.com/uploads/1/3/4/2/134265842/fuwuzufudagesat-gusatazax-putonobanevas.pdfIn PDF document text
  • http://sinsg.com/files/fckeditor/file/44154205315.pdfIn PDF document text
  • https://armature.ir/cache/fck_files/file/fazafipuretinozesan.pdfIn PDF document text
  • https://merten-rozetki.su/kcfinder/upload/files/xumojite.pdfIn PDF document text
  • https://lazav.co.za/XSRYdR1H?utm_term=oreo+opinion+graphic+organizerPDF link annotation
  • https://kunotokadi.weebly.com/uploads/1/3/1/3/131379116/9c73d5e42a8bf66.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00035f9d.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00035f9d.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.