Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
  PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Embedded JS stream low PDF_JS
  PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://yubit.co.za/XSRYdR1H?utm_term=full+music+album++sites PDF link annotation

  • http://viaecommerce.com.br/kcfinder/upload/files/57755755570.pdfIn PDF document text
  • https://www.colfacor.org.ar/administrador_web/kcfinder/upload/files/76607142742.pdfIn PDF document text
  • https://998.geektic.com/geektic/files/8994336339.pdfIn PDF document text
  • http://kaies.net/upfiles/220311181438170653yult0s.pdfIn PDF document text
  • http://www.juniorcollege.cl/ckfinder/userfiles/files/vidobuwufiwufikumalaw.pdfIn PDF document text
  • https://100tmt.com/uploadimage/files/20220201104624.pdfIn PDF document text
  • http://ww2.forte.com.pl/js/ckeditor/kcfinder/uploads/files/70091307993.pdfIn PDF document text
  • http://www.icmtravel.net/assets/ckeditor/kcfinder/upload/files/tewanuwerimikatuzalavam.pdfIn PDF document text
  • https://www.cvr2021.scrs.in/kcfinder/upload/files/30031523315.pdfIn PDF document text
  • https://huanghecables.com/d/files/47362396893.pdfIn PDF document text
  • http://xn--22cjbbm2eyae3ehabdb4kqdtae3dxnnc1fhf.com/user_img/files/juwopuleso.pdfIn PDF document text
  • https://kingyao.com/uploadfiles/files/20220313_224446_9669.pdfIn PDF document text
  • http://www.sunarnuricomuisvealisverismerkezi.com/wp-content/plugins/super-forms/uploads/php/files/uhs8nuinj5u6dcl2kgus112g40/16677015271.pdfIn PDF document text
  • https://austarpharma.austarchina.com/upload/files/16730393039.pdfIn PDF document text
  • http://kochamsushi.pl/UserFiles/file/6974747093.pdfIn PDF document text
  • https://www.grdr.org/paidel/ckfinder/userfiles/files/zabutisu.pdfIn PDF document text
  • https://nhaban24h.com.vn/wp-content/plugins/super-forms/uploads/php/files/7hejb62p3tf4vbif43clctnum6/majixukafajatulewofufodoj.pdfIn PDF document text
  • https://ww170002.linebot.net/upfile/files/20220223180158.pdfIn PDF document text
  • http://caratow.nl/userfiles/file/vakikafasodekalakit.pdfIn PDF document text
  • http://everestlodgelukla.com/userfiles/file/rakegu.pdfIn PDF document text
  • http://way-of-spirit.ru/upload/file/pinojigiwu.pdfIn PDF document text
  • http://okna-stv.ru/userfiles/files/30867959244.pdfIn PDF document text
  • https://www.escolamacrobiotica.pt/backoffice/assets/js/kcfinder/upload/files/58470851076.pdfIn PDF document text
  • http://aitrans.org/UploadFile/file/F1202202070209284001.pdfIn PDF document text
  • http://vpsystem.com/files/fck/39095055252.pdfIn PDF document text
  • http://bloomx.com/sites/all/sites/bloomx.com/files/2122405217.pdfIn PDF document text
  • http://bon-mar.com/fck_user_files/file/rowoluv.pdfIn PDF document text
  • https://10fci.info/userfiles/file/20151961490.pdfIn PDF document text
  • http://mgbig.com/upload_fck/file/2022-2-6/20220206111751584042.pdfIn PDF document text
  • http://janeblondsalon.cz/files/upload/files/47647017274.pdfIn PDF document text
  • http://hamlineparkplaza.com/assets/amund/ckfinder/userfiles/files/burij.pdfIn PDF document text
  • http://standardamulet.com/files/files/sekivose.pdfIn PDF document text
  • https://gifarlcm.com/upfiles/editor/files/84664015580.pdfIn PDF document text
  • http://weifong.tw/fckimages/file/66252719072.pdfIn PDF document text
  • https://myclubowners.com/userfiles/files/8996785673.pdfIn PDF document text
  • https://futuresbuilder.net/dayafter/uploadimages/newsimages/file/51193881579.pdfIn PDF document text
  • http://www.ppspr.org.br/ckeditor/kcfinder/upload/files/wafikamanex.pdfIn PDF document text
  • https://www.xyoaa.org/sites/default/files/files/93366605341.pdfIn PDF document text
  • https://foundationkuzmanov.com/files/23979920033.pdfIn PDF document text
  • http://roberlo.cz/www/files/file/6207798087.pdfIn PDF document text
  • http://chistogood.ru/admin/ckfinder/userfiles/files/49795046539.pdfIn PDF document text
  • https://xn--80aesyq.xn--p1ai/files/file/nujubuxiben.pdfIn PDF document text
  • https://residencialparquenorte.es/kcfinder/upload/images/files/mudiguzaz.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text

  +2 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.