Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://applyforloansnow.ca/site-uploads/kenugawobuvetikil.pdf In PDF document text

  • http://tokyo-sanritsu.com/userfiles/file/sudiranuneneloxudi.pdfIn PDF document text
  • http://www.bombillasconled.com/archivos/files/35246842427.pdfIn PDF document text
  • http://xn--80aer5aza.xn--c1acndkmcarx.xn--p1ai/ckfinder/userfiles/files/37330614277.pdfIn PDF document text
  • http://thriftstorewebsites.net/flash/thriftstorewebsites.net/file/kitukowuzatidugetolor.pdfIn PDF document text
  • https://www.studiopicotti.com/_admin/kcfinder/upload/files/mexatatisezed.pdfIn PDF document text
  • http://recruiters-zone.com/wp-content/plugins/formcraft/file-upload/server/content/files/1620f58a2580f0---45963545934.pdfIn PDF document text
  • https://tssch.in/tssch/application/admin/uploads/file/20681601065.pdfIn PDF document text
  • http://aftckwt.com/uploads/file/30568938202.pdfIn PDF document text
  • http://sevimticaret.net/userfiles/file/68443401947.pdfIn PDF document text
  • http://cuboni.com/uploadfile/hong202203101544407474.pdfIn PDF document text
  • https://ww170002.linebot.net/upfile/files/20220304034309.pdfIn PDF document text
  • http://merten-antik.su/kcfinder/upload/files/88093805889.pdfIn PDF document text
  • http://massimobertoarchitetto.com/userfiles/files/vafolepolawuvo.pdfIn PDF document text
  • http://thongthien.vn/upload/files/44892768024.pdfIn PDF document text
  • http://qkmedica.com/uploads/userfiles/file/87590717294.pdfIn PDF document text
  • http://slbreakingnews.com/ckfinder/userfiles/files/2699741268.pdfIn PDF document text
  • http://drivescuolaguida.it/userfiles/files/xerixewifizosafop.pdfIn PDF document text
  • http://voyagerav.com/v15/Upload/file/202225826542259.pdfIn PDF document text
  • http://coffeexclusive.co.uk/kcfinder/upload/files/66951183426.pdfIn PDF document text
  • https://exhibitproplus.net/mentorfinancial/page_images/file/96400370652.pdfIn PDF document text
  • http://lse.hu/userfiles/file/38404601397.pdfIn PDF document text
  • https://powerliteaac.com/userfiles/file/pafugurufapatavajoxokiwe.pdfIn PDF document text
  • http://www.corazondelsol.es/ckfinder/userfiles/files/69297323861.pdfIn PDF document text
  • https://www.amazoniaon.com.br/assets/js/ckeditor/kcfinder/upload/files/27177623619.pdfIn PDF document text
  • http://look.bio/kcfinder/upload/files/wimomumujolusox.pdfIn PDF document text
  • http://sudeoksa.com/userfiles/file/20220310080316.pdfIn PDF document text
  • http://zhizhencn.com/filespath/files/20220204141616.pdfIn PDF document text
  • http://zonatourism.com/media/ck/files/63236006960.pdfIn PDF document text
  • http://abevenement.com/kcfinder/upload/files/tobugenolikerafala.pdfIn PDF document text
  • http://tns-china.cn/editor_upload_image/file/fakifoda.pdfIn PDF document text
  • https://www.prowallpanama.com/wp-content/plugins/super-forms/uploads/php/files/a57daa172dbb233d5a4072bedea407e0/wewabubov.pdfIn PDF document text
  • https://bomberosdenavarra.com/userfiles_nexo/files/xajudewirej.pdfIn PDF document text
  • http://deleersnijder-bocaege.be/images/file/46105177243.pdfIn PDF document text
  • http://saigondome.com/uploads/userfiles/file/84984075606.pdfIn PDF document text
  • https://globalathena.com/ckfinder/userfiles/files/xabuxesisulap.pdfIn PDF document text
  • http://hotelclinton.it/userfiles/files/vigibomajuwanorudapuda.pdfIn PDF document text
  • http://bloodfaces.de/attachment/file/29895668536.pdfIn PDF document text
  • http://d-innovation.com/upload/files/5647146115.pdfIn PDF document text
  • http://shinhwajudan.com/userData/board/file/69265076156.pdfIn PDF document text
  • http://oprandi.it/userfiles/files/wogojakadapisole.pdfIn PDF document text
  • http://coomargroup.com/ckfinder/userfiles/files/lanibaxivogema.pdfIn PDF document text
  • http://e-sportis.com/images/upload/3387656374.pdfIn PDF document text
  • https://russiandance.ru/frontend/web/js/kcfinder/upload/files/lagulifuj.pdfIn PDF document text
  • http://wo-kop.pl/userfiles/file/46885099359.pdfIn PDF document text
  • https://snoman.mb.ca/ckfinder/userfiles/files/guzuzovunu.pdfIn PDF document text
  • https://sunuf.co.za/XSRYdR1H?utm_term=dividend+payable+account+in+balance+sheetPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text

  +5 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.