Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://jumiwimov.ru/123?utm_term=affairscloud+current+pdf+capsule

  • http://fesupopimos.66ghz.com/anganwadi_form_online_apply_2019_up.pdf
  • http://bnl-jobs.com/ledekalexigiwigapillxqx2.pdf
  • http://kupuzuzopojesu.22web.org/air_supply_songs_list.pdf
  • http://beach-fruit.fun/62291427036tw0gn.pdf
  • http://vovpomnim.ru/why_is_my_keurig_not_brewing_coffeek8ztc.pdf
  • http://xulikugo.iblogger.org/cibt_russian_visa_application_form.pdf
  • http://fukuzowi.sportsontheweb.net/as_bill_sees_it_free.pdf
  • http://mon-compte-cmb.best/30956743127abjvk.pdf
  • http://viniveba.mywebcommunity.org/free_download_mp3_ost_the_heirs_full_album.pdf
  • http://tebogekememesij.mygamesonline.org/belupidifejenidotid.pdf
  • http://centerverifybadge.com/85716819818hl683.pdf
  • http://www.ascendercorp.com/
  • http://www.ascendercorp.com/typedesigners.html
  • http://fedorahosted.org/lohit
  • http://beliraguw.onlinewebshop.net/povogusujexevalid.pdf
  • http://vumamuv.myartsonline.com/89977400339.pdf
  • http://sakizelezodumeb.rf.gd/novuwonekipoda.pdf
  • http://poserub.rf.gd/54533820861.pdf
  • https://s3.amazonaws.com/gotitibekovi/android_studio_installation_failed_with_message_null.pdf
  • https://s3.amazonaws.com/bofake/30578245097.pdf
  • https://s3.amazonaws.com/kovibu/isometric_dot_drawing_worksheets.pdf
  • https://uploads.strikinglycdn.com/files/3e98171c-2512-4653-abda-4749adbee382/infinite_money_glitch_gta_5_xbox_one.pdf
  • http://fevufubot.rf.gd/tutorial_sketchup_2016_bahasa_indonesia.pdf
  • https://uploads.strikinglycdn.com/files/5f771a45-43c7-4c32-8b4a-5c9edcce4584/how_do_i_register_my_house_with_the_post_office.pdf
  • https://s3.amazonaws.com/lewuli/appraisal_form_answers.pdf
  • http://guligovidafijew.rf.gd/python_learning_books_free.pdf
  • https://uploads.strikinglycdn.com/files/2ae0b5fd-2a09-4512-9686-9229aa2b58ba/clasificacin_de_funciones_algebraicas.pdf
  • http://lifanotuju.epizy.com/where_to_buy_pmbok_6th_edition.pdf
  • https://s3.amazonaws.com/bizamesuwepe/39680729168.pdf
  • http://sobibuxasegisun.rf.gd/how_to_make_sub_bookmark_in.pdf
  • http://desixomagi.epizy.com/how_to_tell_if_acne_is_healing.pdf
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • http://purl.org/dc/elements/1.1/
  • http://ns.adobe.com/pdf/1.3/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/rights/
  • http://scripts.sil.org/OFL
  • http://www.geocities.com/mitra_anirban/hobbies.htmGNU
  • http://www.gnu.org/copyleft/gpl.htmRegular

Open this report in the interactive analyzer, or submit your own file for analysis.