Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://yubit.co.za/XSRYdR1H?utm_term=landscape+wedding+invitations+free+templates PDF link annotation

  • https://springfordfarm.com/sites/default/files/uploads/file/nebasagutadu.pdfIn PDF document text
  • http://karinameal.ru/imgdish/files/famesoxemixubuxazatofidep.pdfIn PDF document text
  • https://affze.com/userfiles/file/68730422211.pdfIn PDF document text
  • http://www.nandomoraes.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1613c0ecc342ac---78982927407.pdfIn PDF document text
  • https://techlan.pl/files/file/78103838474.pdfIn PDF document text
  • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1619116bc8d405---33846958505.pdfIn PDF document text
  • http://ipjanah.ir/wp-content/plugins/super-forms/uploads/php/files/0e9n3bcpbcgc44i263qiik27ah/63068780175.pdfIn PDF document text
  • http://t-p-fortune.com/userfiles/file/99885499006.pdfIn PDF document text
  • https://marblo.com/app/webroot/img/files/41304229429.pdfIn PDF document text
  • http://kursadowicz.pl/Upload/file/rawetudaxowurikakuzusaxun.pdfIn PDF document text
  • http://simsvizag.com/admin/uploadedfiles/file///61142429340.pdfIn PDF document text
  • http://recit-de-vie.fr/userfiles/file/rubejetalazeve.pdfIn PDF document text
  • https://nbretail.com.vn/ckfinder/userfiles/files/juzujekaluzugakateputawol.pdfIn PDF document text
  • http://ginzaramen.us/uploads/files/jusibubomokogubus.pdfIn PDF document text
  • http://baharemadinah.com/wp-content/plugins/formcraft/file-upload/server/content/files/1615ea7077ace9---58723117904.pdfIn PDF document text
  • http://kaies.net/upfiles/file/vapupobolagonizegaxerovo.pdfIn PDF document text
  • http://shrlie.com/upload_fck/file/2021-11-4/20211104121512893775.pdfIn PDF document text
  • https://medpressa.ru/files/file/xajigipixedid.pdfIn PDF document text
  • https://christembassybarking.org/wp-content/plugins/super-forms/uploads/php/files/6b6f1b049679f94c0978d5dec037f3de/vexigelivisasovitotino.pdfIn PDF document text
  • https://najarshi.com/basefile/najarshicom/files/fugadepovena.pdfIn PDF document text
  • http://linyuepharm.com/upload/files/wusakavazobuf.pdfIn PDF document text
  • http://mkconline.com/landmark/ckfinder/userfiles/files/71070426005.pdfIn PDF document text
  • https://hotelmitrutarija.com/uploaded/files/76083356863.pdfIn PDF document text
  • https://tezerwatch.com/file/upload/files/09-23-06-07-54-60.pdfIn PDF document text
  • http://studiotecnicopinto.it/userfiles/files/bewajivano.pdfIn PDF document text
  • http://arrhythmiaclinic.com/userfiles/file/20210926130246.pdfIn PDF document text
  • http://otvorene-srdce.sk/userfiles/file/87227866402.pdfIn PDF document text
  • http://energo-winstal.pl/userfiles/file/99316193428.pdfIn PDF document text
  • http://paymentsbusiness.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16136f6b606c8b---pigel.pdfIn PDF document text
  • http://dieterheich.de/images/uploads/file/sivazimonenebevis.pdfIn PDF document text
  • http://www.americandartsmadrid.com/kcfinder/upload/files/72907548421.pdfIn PDF document text
  • http://hitecds.com/userfiles/file/basuwopobopewuroxawewuf.pdfIn PDF document text
  • https://digireg.at/upload/rarutisazuzo.pdfIn PDF document text
  • https://cmri.ckbirlahospitals.com/controlpanel/kcfinder/upload/files/25349556474.pdfIn PDF document text
  • https://photofetimages.com/26470146137.pdfIn PDF document text
  • http://elmiraclassiccountry.com/wp-content/plugins/super-forms/uploads/php/files/0bc0f1532c7faef78ea98326106d2a32/92411678348.pdfIn PDF document text
  • http://sinara.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/16100e0fdcdee2---89654641002.pdfIn PDF document text
  • http://www.brennholz-heinlein.de/wp-content/plugins/formcraft/file-upload/server/content/files/160ec436aa60ed---mewawosokes.pdfIn PDF document text
  • https://allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/f66c2b3bde6614c709ae29c40b7f63c0/jufak.pdfIn PDF document text
  • http://daisin1977.com/js/upload/files/gunopekexopozoganoxema.pdfIn PDF document text
  • https://homeaestheticsllc.com/wp-content/plugins/super-forms/uploads/php/files/0c9e4c90073ffbdda5afcd3826c2735e/zazikakedilisi.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000388d3.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off000388d3.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.