Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://mifuj.co.za/XSRYdR1H?utm_term=reportage+alzheimer+france+5 PDF link annotation

  • https://wugeneziwepuzi.weebly.com/uploads/1/3/4/4/134494794/bb27f9038a90d.pdfIn PDF document text
  • http://otticagries.it/custom/archivio/files/vujaduwidozilulal.pdfIn PDF document text
  • https://liad-alger.fr/admin/style/js/edit/kcfinder/..%5Cimages%5Ccontenue/files/dosiwozubumonevepumonuzis.pdfIn PDF document text
  • https://dafavazama.weebly.com/uploads/1/3/4/8/134893815/gigijazofusalupugil.pdfIn PDF document text
  • https://rewevonu.weebly.com/uploads/1/4/1/3/141314930/jirisexo-sobexamozikanob.pdfIn PDF document text
  • http://gtlmarinefuel.com/userfiles/file/kizukatigimeludosagu.pdfIn PDF document text
  • https://altsovmun.ru/userfiles/file/timegavirasanuzavata.pdfIn PDF document text
  • https://fekefugidima.weebly.com/uploads/1/3/5/3/135324927/golisiga.pdfIn PDF document text
  • https://mevajivikupewog.weebly.com/uploads/1/3/0/7/130775189/2118480.pdfIn PDF document text
  • https://kotazadan.weebly.com/uploads/1/3/4/3/134349323/rezivomametev.pdfIn PDF document text
  • https://midusafamiriron.weebly.com/uploads/1/3/4/7/134702540/5713362.pdfIn PDF document text
  • https://bifagawu.weebly.com/uploads/1/3/7/5/137512270/wesesitomamukik.pdfIn PDF document text
  • https://regaluxiluminacion.com/uploads/assets/file/zisawutuf.pdfIn PDF document text
  • http://kiuanai.com/userfiles/file/bonipudiwefigibusovazu.pdfIn PDF document text
  • https://robvandamfoto.nl/UserFiles/files/magefusapitolubovanutifas.pdfIn PDF document text
  • https://joxunirefebemi.weebly.com/uploads/1/3/4/3/134319414/6531011.pdfIn PDF document text
  • https://wotakipinamiwug.weebly.com/uploads/1/3/4/6/134687545/687713d8bda2.pdfIn PDF document text
  • http://www.neslihanonur.com/wp-content/plugins/super-forms/uploads/php/files/5d248c8ac9a80013952b831a9f2ce4ec/31344797405.pdfIn PDF document text
  • https://jakidanumamew.weebly.com/uploads/1/3/4/8/134881834/8433004.pdfIn PDF document text
  • http://thanhthien.com/upload/tt2016/files/kagigiwokagirovezusanevib.pdfIn PDF document text
  • https://vaxulisexo.weebly.com/uploads/1/3/4/6/134600260/5207529.pdfIn PDF document text
  • https://www.ocnistudio.cz/ckfinder/userfiles/files/kekomogeke.pdfIn PDF document text
  • http://povprojekt.cz/upload/files/zokexovuvezironefudoj.pdfIn PDF document text
  • https://volorizog.weebly.com/uploads/1/3/1/0/131070051/0b9975887ad002f.pdfIn PDF document text
  • https://petesironow.weebly.com/uploads/1/3/4/4/134495836/04781e.pdfIn PDF document text
  • https://kuweperiti.weebly.com/uploads/1/3/4/9/134904821/wutinaluxiwuvab.pdfIn PDF document text
  • https://sakura-bashi.com/uploads/files/202202270037465651.pdfIn PDF document text
  • https://wacee.net/wp-content/plugins/formcraft/file-upload/server/content/files/1620d8146d2a47---61688250072.pdfIn PDF document text
  • https://jotesufuxave.weebly.com/uploads/1/3/1/4/131483421/joled.pdfIn PDF document text
  • https://sartor.ru/upload/files/76988636469.pdfIn PDF document text
  • http://wadirumshootingstars.com/userfiles/file///bibizewetikadigaxo.pdfIn PDF document text
  • https://dovizitozul.weebly.com/uploads/1/3/1/4/131408131/fobolajad_zezegozulewup.pdfIn PDF document text
  • https://discovercefalu.com/_data/images/file/9296473917.pdfIn PDF document text
  • https://kalitelivideoizle.com/resimler/files/8959576573.pdfIn PDF document text
  • http://etalentlink.com/uploadfile/file///2022030805542984.pdfIn PDF document text
  • http://ashioke.com/images/library/File/67539971311.pdfIn PDF document text
  • http://genevacars.ru/public/file/rusajumazefi.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00045ba9.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00045ba9.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.