Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://lazav.co.za/XSRYdR1H?utm_term=music+education+lesson+plan+template PDF link annotation

  • http://agierresrl.it/userfiles/files/popen.pdfIn PDF document text
  • https://bike-accessories.supersites.gr/content/ckfinder/files/87129134620.pdfIn PDF document text
  • https://halkapsikoloji.com/userfiles/file/51468818840.pdfIn PDF document text
  • http://pierrevillers.fr/mairie_files/file/koneg.pdfIn PDF document text
  • http://cellesekorea.com/ckupload/files/81558255830.pdfIn PDF document text
  • http://capitaloffice.pl/fotki/file/7243723729.pdfIn PDF document text
  • http://njxinbell.com/upload/files/selosudofe.pdfIn PDF document text
  • http://photopuzzle.net/userData/board/file/javidafu.pdfIn PDF document text
  • http://wwsm-hk.com/files/file/5637408948.pdfIn PDF document text
  • https://chasselas-de-moissac.com/assets/kcfinder/upload/files/50001919664.pdfIn PDF document text
  • https://ohligschlaeger-berger.de/wp-content/plugins/formcraft/file-upload/server/content/files/1610de58000150---82996940447.pdfIn PDF document text
  • http://www.andreapondika.cz/file/73526733316.pdfIn PDF document text
  • http://southfieldhigh1973.com/clients/2/27/27a5067865c8334ad4a5a1fd7642c928/File/tuvijokowijuxonavaxokoxe.pdfIn PDF document text
  • https://alyosserspneed.com/userfiles/files/pafovotirexirakototexov.pdfIn PDF document text
  • https://study4student.com/cache/fck_files/file/3126609862.pdfIn PDF document text
  • http://luyenthidhcanhsat.com/Images_upload/files/luxeti.pdfIn PDF document text
  • https://jaunimodienos.lt/wp-content/plugins/super-forms/uploads/php/files/nhgambfc5tvdtme48m6h1033c7/datetemifo.pdfIn PDF document text
  • https://gogreenonline.net/userfiles/image/fckeditor/file/86848541791.pdfIn PDF document text
  • https://trade.inter-ural.ru/ckfinder/userfiles/files/rowozirodoj.pdfIn PDF document text
  • http://vlajamo.cz/images/file/buzani.pdfIn PDF document text
  • https://toyotaautobody.com/ckfinder/userfiles/files/gizavowifowagomov.pdfIn PDF document text
  • http://dkind.net/userData/board/file/94889433663.pdfIn PDF document text
  • https://fobh.net/userfiles/files/vatobobefimal.pdfIn PDF document text
  • https://jodhpurtravels.com/nbloom/fckuploads/file/5212688317.pdfIn PDF document text
  • http://www.peritaonline.es/ckfinder/userfiles/files/88035062628.pdfIn PDF document text
  • https://lwim-ouargla.dz/ar/files/tubexajeza.pdfIn PDF document text
  • http://pune-india.info/userfiles/file/69810016575.pdfIn PDF document text
  • http://biotop-zamosc.pl/userfiles/file/nexujimiwedufogabulenada.pdfIn PDF document text
  • https://www.rougeindigo.com/ckfinder/userfiles/files/tawunofajemosamedakoga.pdfIn PDF document text
  • http://lagrupacio.cat/file/28856952938.pdfIn PDF document text
  • http://challendor.com/fckeditor/upload/file/sedabenofejivesefopusagur.pdfIn PDF document text
  • http://szhlfz.net/upload/58885135847.pdfIn PDF document text
  • https://siyata.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/16191d9faab903---79973937889.pdfIn PDF document text
  • https://pecsikult.hu/files/file/67612820664.pdfIn PDF document text
  • http://standartbio.com/fckfiles/file/43395492116.pdfIn PDF document text
  • http://www.kymenhome-etsinta.net/tiedostot/files/77259022676.pdfIn PDF document text
  • http://juraganbajumurah.com/kcfinder/upload/files/lokotamabukinimumidolumij.pdfIn PDF document text
  • http://ottomaniantextile.com/userfiles/file/3683130129.pdfIn PDF document text
  • http://oroblupiscine.it/userfiles/files/nidegiwojowopegefezaj.pdfIn PDF document text
  • https://successalpha.team/upload/files/mamutumu.pdfIn PDF document text
  • http://majortaylorride.info/images/uploaded/file/belalorepokoxanaruk.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.