Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
  Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://garglob.ru/pbw?utm_term=o2+diamagnetic+or+paramagnetic PDF link annotation

  • https://cdn-cms.f-static.net/uploads/4487186/normal_6056f15547b3f.pdfIn PDF document text
  • https://popaxeras.weebly.com/uploads/1/3/0/8/130814769/2447729.pdfIn PDF document text
  • https://barijimuje.weebly.com/uploads/1/3/1/4/131406344/zexedepelu_fopuron_konalenajixop_leririmixugezo.pdfIn PDF document text
  • https://vilukenuxe.weebly.com/uploads/1/3/2/8/132814007/1461289.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4459788/normal_602f9b1d86067.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4393759/normal_600830cb47765.pdfIn PDF document text
  • https://bupowuxa.weebly.com/uploads/1/3/5/3/135317106/mobuvoxatosuwiru.pdfIn PDF document text
  • https://pozefixinez.weebly.com/uploads/1/3/1/4/131454190/2ff8c643.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://www.opentle.orgIn PDF document text
  • https://uploads.strikinglycdn.com/files/39d4b1d1-e428-4ec8-b766-401739ecb0c6/the_wisdom_of_crowds_peter_watts.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/a575b402-c497-446b-8b2f-0c75646eed06/desuxisamumome.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/be2df6df-f14d-4595-bf74-65bce6ba2953/technical_business_writing_course_outline.pdfIn PDF document text
  • http://mudowomuxexo.pbworks.com/f/lego_titanic_guide.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f834f630-0406-4cc2-8b17-afb1afa1c158/xakam.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/81aa4f13-de35-4dbe-9678-4a00398d473a/how_to_write_a_descriptive_writing_about_a_person.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/43a50e12-79b6-446a-95b4-8caf3065fac9/dixetozusilodurojak.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ee623f9d-e34b-4bd8-8015-716340417a12/que_es_liderazgo_liberal.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/04c4ead8-fc97-4782-9dba-3c2dde53ef4e/63352874756.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/b89aac64-5d6b-4220-9180-aea1a3f862c3/adobe_photoshop_7.0_free_download_for_pc_with_key.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2c654ac8-3010-4a9c-95a0-9bd5a023a909/28617029059.pdfIn PDF document text
  • http://xokizobaf.pbworks.com/w/file/fetch/145025859/sawijixosipatelasutari.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ff96d256-ff5c-4733-9852-e4bdc84b43ba/32546606922.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/36a73ec0-c496-4df3-9a36-c7d332c7c334/rosotewefo.pdfIn PDF document text
  • http://pajinap.pbworks.com/w/file/fetch/144500040/what_is_the_definition_of_reproduce_asexually.pdfIn PDF document text
  • http://vikiruji.pbworks.com/f/47533461425.pdfIn PDF document text
  • http://wuranosa.pbworks.com/f/87235234048.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/e558eeb6-027f-4c9a-b6c0-7b5e5d2d47e0/how_many_votes_does_bts_have_2020_in_total.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.