Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://sunuf.co.za/XSRYdR1H?utm_term=yamaha+htr+5760+manual+pdf PDF link annotation

  • https://nunoperiv.weebly.com/uploads/1/3/1/8/131856708/5388b2283b115bf.pdfIn PDF document text
  • https://joxufomuvonabu.weebly.com/uploads/1/3/4/4/134474754/1739750.pdfIn PDF document text
  • https://sivasanetit.weebly.com/uploads/1/3/6/0/136095735/f3d86b99f4.pdfIn PDF document text
  • https://kopomitesukov.weebly.com/uploads/1/3/1/4/131453216/pevositomoj.pdfIn PDF document text
  • https://fibutoledul.weebly.com/uploads/1/3/2/7/132741024/juwodobewomizew.pdfIn PDF document text
  • https://totovipuvo.weebly.com/uploads/1/3/2/7/132740708/fdb6a549.pdfIn PDF document text
  • https://tojoxiwumo.weebly.com/uploads/1/3/4/3/134319360/f7be5f1ec4c0.pdfIn PDF document text
  • https://rodefakuwutepez.weebly.com/uploads/1/3/4/3/134341390/7c1146598.pdfIn PDF document text
  • https://gifawinap.weebly.com/uploads/1/3/4/3/134386913/14fcd894d846c03.pdfIn PDF document text
  • http://compufoxmail.com/FCKeditor/editor/filemanager/connectors/userfiles/file/natedenakutatisanakap.pdfIn PDF document text
  • http://anquocrealty.com/uploads/image/files/25444824398.pdfIn PDF document text
  • https://kuviwavu.weebly.com/uploads/1/3/1/6/131606254/8431342.pdfIn PDF document text
  • http://hyswimpool.com/userfiles/85662820169.pdfIn PDF document text
  • https://gemefakopegixi.weebly.com/uploads/1/3/4/3/134309359/buwofexo.pdfIn PDF document text
  • https://mamamusesutur.weebly.com/uploads/1/3/4/3/134359404/vexawawegonetiles.pdfIn PDF document text
  • https://jofajode.weebly.com/uploads/1/3/5/3/135346524/kasum.pdfIn PDF document text
  • https://zunitaxipef.weebly.com/uploads/1/3/1/3/131398356/wuvigix-wotese-xuwosatewosup.pdfIn PDF document text
  • https://tavikumor.weebly.com/uploads/1/3/4/4/134476146/bobamuzozarelef.pdfIn PDF document text
  • http://tarnava.eu/user_images/file/laranir.pdfIn PDF document text
  • https://xunitaminovo.weebly.com/uploads/1/3/5/3/135349323/sofejopuvemirid.pdfIn PDF document text
  • https://mogisitubetaw.weebly.com/uploads/1/3/4/4/134496388/berebube-sijuwatukoge.pdfIn PDF document text
  • https://bidukupe.weebly.com/uploads/1/3/4/3/134348295/lamaporavofeko_nawuxab.pdfIn PDF document text
  • https://ww170002.linebot.net/upfile/files/20220331074834.pdfIn PDF document text
  • https://xixobuba.weebly.com/uploads/1/3/4/8/134898189/25e6b12d8145b99.pdfIn PDF document text
  • https://tevuluzusat.weebly.com/uploads/1/3/5/3/135397550/wonipumavonasevutu.pdfIn PDF document text
  • https://vanimiravupu.weebly.com/uploads/1/3/2/7/132710567/bajijufak.pdfIn PDF document text
  • http://kaithompson.com/userfiles/file/63005546120.pdfIn PDF document text
  • https://romitigab.weebly.com/uploads/1/3/4/8/134864794/bupaluf.pdfIn PDF document text
  • https://www.higher-energy-trampolineclub.com/wp-content/plugins/formcraft/file-upload/server/content/files/162173249ea1c1---ponoditefakul.pdfIn PDF document text
  • https://vaturelola.weebly.com/uploads/1/3/4/7/134704713/3033363.pdfIn PDF document text
  • https://sidufuzijek.weebly.com/uploads/1/3/4/5/134598689/kivafaw.pdfIn PDF document text
  • https://torewofatovamek.weebly.com/uploads/1/3/4/1/134108613/1008631.pdfIn PDF document text
  • https://mulolixebewiw.weebly.com/uploads/1/3/1/3/131383386/4927083.pdfIn PDF document text
  • https://wadodimimilupe.weebly.com/uploads/1/3/0/8/130873890/jetabuserozod-salozolam-mipafujozuj.pdfIn PDF document text
  • https://garupiripo.weebly.com/uploads/1/3/4/3/134386314/6fb1a11c5797e7.pdfIn PDF document text
  • https://ruwagifixub.weebly.com/uploads/1/3/4/0/134013037/mukizo-banerufovar-powagigir-merizamifopila.pdfIn PDF document text
  • https://jejenami.weebly.com/uploads/1/3/4/6/134684972/rebojivofoketol_sonun_vezem_fanubexi.pdfIn PDF document text
  • https://devigumekumowir.weebly.com/uploads/1/3/4/3/134394761/wakef.pdfIn PDF document text
  • https://pojamemurix.weebly.com/uploads/1/3/1/4/131408024/gelewizodatujuz.pdfIn PDF document text
  • http://bebegim.nl/userfiles/file/22863350859.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0003e59d.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0003e59d.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.