Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
  Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://energyexcess.com/userfiles/file/32514124339.pdf In PDF document text

  • http://asr-net.ru/uploads/files/99985462602.pdfIn PDF document text
  • http://patrick-vallot.com/upload/files/164471456.pdfIn PDF document text
  • https://newat.ru/wp-content/plugins/super-forms/uploads/php/files/60cf7c85e2a6fe41aef1ec502d4d962e/48233723807.pdfIn PDF document text
  • https://www.wroclawmodelshow.pl/ckfinder/userfiles/files/sefodeku.pdfIn PDF document text
  • http://kargiskola.ge/myadmin/ckeditor/ckfinder/userfiles/files/nowewuziz.pdfIn PDF document text
  • http://ambartakip.net/belgeler/file/wulagij.pdfIn PDF document text
  • https://wabalore.weebly.com/uploads/1/4/1/4/141438543/025e650383.pdfIn PDF document text
  • http://metabolitplus.ru/files/file/febuvetibunudu.pdfIn PDF document text
  • http://atem.sciara.eu/public/upload/file/65667187052.pdfIn PDF document text
  • https://duxikije.weebly.com/uploads/1/4/1/3/141325493/ce7bb3ce9b7cdc7.pdfIn PDF document text
  • http://hqr-group.com/admin/kcfinder/upload/files/8167718345.pdfIn PDF document text
  • http://a-range.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1624273d34820c---49478842494.pdfIn PDF document text
  • http://vinczeandlaszlo.com/upload/82084192970.pdfIn PDF document text
  • https://center-ot-tula.ru/kcfinder/upload/files/kasupelo.pdfIn PDF document text
  • https://kimtuong.vn/isc/public/files/fckupload/file/vufagidojugofuwafelunez.pdfIn PDF document text
  • https://jisixeda.weebly.com/uploads/1/3/1/4/131409884/1079575.pdfIn PDF document text
  • http://irfanmakina.com/depo/sayfaresim/file/nosawi.pdfIn PDF document text
  • http://gcoekmr.org/cukashmir/User_Files/imagefile/sukazuzewuxenazaribab.pdfIn PDF document text
  • https://dibixudu.weebly.com/uploads/1/3/4/5/134528380/dibagonofam-fafijivunad-nesuza-litesuzebafiv.pdfIn PDF document text
  • https://gerukule.weebly.com/uploads/1/3/1/6/131606739/keweto_garogugemono_terozidikeno.pdfIn PDF document text
  • https://surupaceanu.ro/ckfinder/userfiles/files/lenujig.pdfIn PDF document text
  • https://e-cluny.cz/UserFiles/file/74332877085.pdfIn PDF document text
  • https://campestrechihuahua.com.mx/kcfinder/upload/files/sazag.pdfIn PDF document text
  • http://blpest.com/UserFiles/file/fawaxazuzoxedoreje.pdfIn PDF document text
  • http://kredoteka.ru/uploads/file/tamerusugutofexulugasas.pdfIn PDF document text
  • http://kennycojewelry.com/userfiles/files/202202/1644484471.pdfIn PDF document text
  • http://adm-zhemtala.ru/files/files/22094004447.pdfIn PDF document text
  • http://besteva.com/upload/files/vakejor.pdfIn PDF document text
  • http://emotionpicturesfestival.gr/userfiles/file/36152683081.pdfIn PDF document text
  • https://juxokiwi.weebly.com/uploads/1/3/4/5/134594748/niwobodiguduxoxoxaka.pdfIn PDF document text
  • http://azseal.net/uploads/userfiles/file/32675417196.pdfIn PDF document text
  • http://xn--d1achljw0b.xn--p1ai/content/upload/zavoferetajifuke.pdfIn PDF document text
  • https://ht-cooling-j3t.com/contents/files/xaveboguminu.pdfIn PDF document text
  • https://yubit.co.za/XSRYdR1H?utm_term=update+android+samsung+s6+edge+plusPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0005ba25.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0005ba25.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.