Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Embedded JS stream low PDF_JS
  PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://lazav.co.za/XSRYdR1H?utm_term=publisher+understated+calendar+template PDF link annotation

  • https://zugatesek.weebly.com/uploads/1/3/6/0/136082504/5358164.pdfIn PDF document text
  • http://xn--b1amishc2fb.xn--p1ai/ckfinder/userfiles/files/3166231786.pdfIn PDF document text
  • https://kusebedanosude.weebly.com/uploads/1/3/1/1/131163667/0f230f068dfa9.pdfIn PDF document text
  • http://smartbazar.online/app/webroot/upload/files/gogixofiz.pdfIn PDF document text
  • http://honda-vo.com/upload/file/sivivisubotuvakomaxup.pdfIn PDF document text
  • https://zavutaneba.weebly.com/uploads/1/3/0/8/130813369/2bf87a.pdfIn PDF document text
  • http://boonfagrandhome.com/user_img/files/wagajogomusivefepotum.pdfIn PDF document text
  • https://sutukukibefatu.weebly.com/uploads/1/3/4/4/134486522/tokosomi.pdfIn PDF document text
  • http://daeryuhealthcare.com/ckupload/files/zulafosokufodobolibipiro.pdfIn PDF document text
  • https://gifukupuwabe.weebly.com/uploads/1/3/0/7/130775529/6753407.pdfIn PDF document text
  • https://vivuguduwidu.weebly.com/uploads/1/3/2/6/132681484/wafab-zefano.pdfIn PDF document text
  • https://japujavawewiri.weebly.com/uploads/1/3/2/6/132696154/17a6cef4f7f71.pdfIn PDF document text
  • https://repewagisax.weebly.com/uploads/1/3/5/3/135319399/b31963cf.pdfIn PDF document text
  • http://gnbc-global.com/app/webroot/js/kcfinder/upload/files/kotifopuleloponugezosomad.pdfIn PDF document text
  • https://vazatevetag.weebly.com/uploads/1/3/0/8/130874289/nozixufeduv.pdfIn PDF document text
  • https://varusimutajol.weebly.com/uploads/1/3/4/5/134502614/1064366.pdfIn PDF document text
  • https://girisuwudogepo.weebly.com/uploads/1/3/0/7/130776006/6016156.pdfIn PDF document text
  • http://pelejas.com/IMAGENS/CKFINDER/files/47715148658.pdfIn PDF document text
  • https://nokesopupikes.weebly.com/uploads/1/3/4/7/134767934/pivapotikulefa.pdfIn PDF document text
  • https://rovenefewapug.weebly.com/uploads/1/3/0/7/130775308/kusivunok.pdfIn PDF document text
  • https://tonixomakotej.weebly.com/uploads/1/4/1/2/141253677/79c1f95.pdfIn PDF document text
  • https://mafidusat.weebly.com/uploads/1/3/4/1/134109097/wavunubodu-tezivu.pdfIn PDF document text
  • https://donasidavojixa.weebly.com/uploads/1/3/4/4/134494786/8376737.pdfIn PDF document text
  • http://ghanzi.net/kcfinder/upload/files/25787136971.pdfIn PDF document text
  • http://dachastyle.com/userfiles/file/teveduxus.pdfIn PDF document text
  • https://owop.challengersports.com/userfiles/files/13240082909.pdfIn PDF document text
  • https://www.ajmetaldesign.sk/gfx/administration/js/ckeditor/kcfinder/upload/files/2542068366.pdfIn PDF document text
  • https://sindicav.com.br/ckeditor/ckfinder/userfiles/files/93091381287.pdfIn PDF document text
  • https://ferowadamo.weebly.com/uploads/1/3/4/5/134593689/vapezadelu.pdfIn PDF document text
  • https://dineshlms.com/userfiles/file/kasezowotunogir.pdfIn PDF document text
  • http://atlantidaagency.com/kcfinder/upload/files/bebesotazenikijoneseb.pdfIn PDF document text
  • https://nunamifeko.weebly.com/uploads/1/3/2/7/132740424/vumejovizojowuliseka.pdfIn PDF document text
  • https://intertelleader.com/FCKupload/file/10336807739.pdfIn PDF document text
  • http://ilpiccantino.it/admin/data/img/uploads/files/notabijovinojakajarej.pdfIn PDF document text
  • https://sigajijatikad.weebly.com/uploads/1/3/1/3/131379485/volekixikuvebibeve.pdfIn PDF document text
  • https://ragoxinigavaguf.weebly.com/uploads/1/4/1/2/141293305/medigireten.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.