Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• SEO-redirector lure link (multi-word utm_term) low PDF_SEO_UTM_REDIRECTOR_LINK
  PDF contains a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the search-keyword gateway used by the 'free document download' phishing family. Surfaced as an IOC; on its own this is a low-confidence signal.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://cafij.co.za/XSRYdR1H?utm_term=free++tri+fold+brochure+designs PDF link annotation

  • https://accounting789.com/ThImg/file/43622463212.pdfIn PDF document text
  • http://bilasiparacollege.org/assets/kcfinder/upload/files/raxekow.pdfIn PDF document text
  • http://jatechkj.pl/upload/fck/file/88938397887.pdfIn PDF document text
  • https://zaindu.drogomedia.com/files/galeria/files/16483685146.pdfIn PDF document text
  • https://australiancaravancentre.com.au/application/third_party/ckfinder/userfiles/files/2189555042.pdfIn PDF document text
  • http://ontis.sk/editor_uploads/system/files/82448166757.pdfIn PDF document text
  • https://hasekei.jp/userfiles/file/nopojisuborafok.pdfIn PDF document text
  • http://japhina.com/upload/file/tunuririkad.pdfIn PDF document text
  • http://collectifff.be/imgdb/accueil/files/40409549727.pdfIn PDF document text
  • https://citytrafik.nu/images/file/76610796363.pdfIn PDF document text
  • http://chianchang.yun2u.com/upload/files/nawunanofipemefodetaxe.pdfIn PDF document text
  • https://aykutemlak.com/upload/ckfinder/files/zoxukubemixisamufanutobo.pdfIn PDF document text
  • http://theartofdesign.nl/ckfinder/userfiles/files/74601808304.pdfIn PDF document text
  • https://mavibusiness.it/file/9884730096.pdfIn PDF document text
  • http://www.fd.ntou.edu.tw/ckfinder/userfiles/files/nekapise.pdfIn PDF document text
  • http://www.razitka-conti-trodat.cz/kcfinder/upload/files/pareda.pdfIn PDF document text
  • http://kiddeefire.com/media/userfiles/files/vuzutijoj.pdfIn PDF document text
  • http://kientrucmoi.com.vn/admin/kcfinder/upload/files/molunilabasu.pdfIn PDF document text
  • https://myreply.mobi/snappshott/editor///file/belemepo.pdfIn PDF document text
  • http://paoladebenedetti.eu/userfiles/files/pubevopoxobobarez.pdfIn PDF document text
  • http://brianhaymore.com/images/e/file/xojawojaxadakaw.pdfIn PDF document text
  • https://elsa-daulte.com/ckfinder/userfiles/files/92227340841.pdfIn PDF document text
  • http://hasdeu.md/data/userfiles/files/xudukuxop.pdfIn PDF document text
  • http://www.77ice.com/upload/files/28384402992.pdfIn PDF document text
  • http://mothertheresapublicschool.com/userfiles/file/20070348152.pdfIn PDF document text
  • http://reside-realestate.de/user_files/files/73906332299.pdfIn PDF document text
  • https://rcot.org/userfiles/file/54109488242.pdfIn PDF document text
  • http://alrabbancapital.com/file/files/jaramufajezifotobef.pdfIn PDF document text
  • http://limobebe.com/userfiles/files/rimusewixorifopuzopegaf.pdfIn PDF document text
  • http://www.armstrongre.com/files/files/duxisazuvosejenog.pdfIn PDF document text
  • http://files.ibiza-ferien.de/file/tapiruvufopujexepekodo.pdfIn PDF document text
  • http://bipaf.org/2009_home/upload/editor/file/vewizojuzasunagodabil.pdfIn PDF document text
  • https://siyata.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/16194fa938ced7---99368340337.pdfIn PDF document text
  • http://ghinelliarchitettura.it/userfiles/files/volufa.pdfIn PDF document text
  • http://mazdooradda.com/userfiles/file/manixulewomogiginine.pdfIn PDF document text
  • http://mosjob.ru/images/file/gekig.pdfIn PDF document text
  • http://dpkwi.org/userfiles/files/83450887016.pdfIn PDF document text
  • http://ingpoggi.eu/userfiles/files/4910157788.pdfIn PDF document text
  • https://pajareria.webcordoba.net/kcfinder/upload/files/43547792452.pdfIn PDF document text
  • https://eirai.org/editor/ckfinder/userfiles/files/sovofe.pdfIn PDF document text
  • https://www.partyshuttlebus.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1614a1048be000---47377010080.pdfIn PDF document text
  • http://ansing.nl/userfiles/file/87256611751.pdfIn PDF document text
  • https://iamluno.com/wp-content/plugins/formcraft/file-upload/server/content/files/161a652fa1d309---xubonojikezorikinikemow.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text

  +2 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.