Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Callback phishing phone lure medium SE_CALLBACK_LURE
  Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://nomylo.ru/square?utm_term=treatment+to+become+fair PDF link annotation

  • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e932d558c6623f0382dd64/1625895637902/renide.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f7025d4f244e516a093f1b/1626800733717/present_simple_and_present_continuous_questions_exercises.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f25a446d5e991e36d64f66/1626495556621/bunuwerofozojujevufes.pdfIn PDF document text
  • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e80f23f29cd6423db660dc/1625820963260/88634563850.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e8716abc230c38be4baf57/1625846123063/luteal_phase_fsh_and_lh_levels.pdfIn PDF document text
  • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60f0696ed54ecf6408d7a6d1/1626368366999/sojasowinezavov.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f76e82a5a05d5f5f9ced49/1626828418132/active_passive_voice_rules_chart_in_english.pdfIn PDF document text
  • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f5a2e0f543557822c80a9f/1626710753316/happy_new_year_quotations_2021.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f176832c92ee1ddde10112/1626437252032/babumamiwosofopiwitofapib.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e8260757d2352c927f5dc8/1625826823438/ryan_reynolds_2_guys_a_girl_and_a_pizza.pdfIn PDF document text
  • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f2c1ed4b68c137e694e098/1626522093559/software_is_a_physical_part_of_the_computer.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ed9ed51374dd6a9a63a50b/1626185429832/measles_rubella_vaccine_side_effects.pdfIn PDF document text
  • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60f0e2e69627e70a9acad688/1626399462499/the_ginormous_book_of_dirty_jokes.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e94f2b0cbdad4d35072e8e/1625902891203/project_report_on_recruitment_and_selection_process_of_a_company.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f2c3b8fb6d8f5e8051888f/1626522553069/kunuvomijuji.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f2b9a16d5e991e36d8e04f/1626519969592/mid_to_mp3_online.pdfIn PDF document text
  • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f26a00c5d9e6782cd82684/1626499584302/60719496121.pdfIn PDF document text
  • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ec7ac819a16f038d617079/1626110664467/93424511539.pdfIn PDF document text
  • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ec822820781e4bb11bbf41/1626112552359/some_facts_about_me.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e8baa94c181567023b9e52/1625864873941/tozaxumadafaxovobizetekuk.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.