Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://norin.co.za/XSRYdR1H?utm_term=fortismere+school+ofsted+report PDF link annotation

  • https://sivipafegedijog.weebly.com/uploads/1/3/4/4/134443607/kunuzumedu-xiruj.pdfIn PDF document text
  • https://gokidobizivoji.weebly.com/uploads/1/3/4/4/134495246/2704555.pdfIn PDF document text
  • https://xasonametig.weebly.com/uploads/1/3/2/3/132303127/0eed8307c4d79.pdfIn PDF document text
  • https://gavanigo.weebly.com/uploads/1/3/1/3/131380609/508aa422.pdfIn PDF document text
  • https://xoxizanelanoruf.weebly.com/uploads/1/3/0/7/130740612/1426338.pdfIn PDF document text
  • https://xikipavukageza.weebly.com/uploads/1/3/0/7/130776529/3337032.pdfIn PDF document text
  • https://dioss.eu/files/ckfiles/file/49344883202.pdfIn PDF document text
  • https://pubedazemel.weebly.com/uploads/1/3/4/8/134870130/5134000.pdfIn PDF document text
  • https://dosukasexu.weebly.com/uploads/1/3/1/6/131637789/balob.pdfIn PDF document text
  • https://vuxizufekek.weebly.com/uploads/1/3/4/8/134864169/7b4b20fd9cea.pdfIn PDF document text
  • https://nusemidokiz.weebly.com/uploads/1/3/5/3/135395372/jajubafirolemi.pdfIn PDF document text
  • https://tewenamizudeko.weebly.com/uploads/1/3/0/8/130873709/sasuki.pdfIn PDF document text
  • https://wiguvebilef.weebly.com/uploads/1/3/5/3/135389097/2894729.pdfIn PDF document text
  • https://fizilotot.weebly.com/uploads/1/3/6/0/136050642/2508939.pdfIn PDF document text
  • https://sejejuno.weebly.com/uploads/1/3/4/4/134447194/vudimorenirofu_zosiruxerubiba_bawikufexapovof.pdfIn PDF document text
  • https://ropidofizo.weebly.com/uploads/1/3/0/7/130738616/lanefozuve.pdfIn PDF document text
  • http://gorre-paysage.fr/ckeditor/kcfinder/upload/files/30466685295.pdfIn PDF document text
  • https://gasirawudalanud.weebly.com/uploads/1/4/1/2/141251143/fesod_vowelekizisajer.pdfIn PDF document text
  • https://pudonezex.weebly.com/uploads/1/3/4/6/134674437/55c10.pdfIn PDF document text
  • https://rovetizewi.weebly.com/uploads/1/3/0/7/130776299/sosalibefis-lasokud.pdfIn PDF document text
  • https://fifewefogajes.weebly.com/uploads/1/3/4/6/134608928/2cfc6.pdfIn PDF document text
  • https://pelabinal.weebly.com/uploads/1/3/1/3/131379552/1882fa50e3136.pdfIn PDF document text
  • http://sweatrinserepeat.com/ckfinder/userfiles/files/nedofotorowax.pdfIn PDF document text
  • https://vevitukag.weebly.com/uploads/1/3/7/5/137506107/kowafubes-volije-dozagifuwezi-gazoserulewo.pdfIn PDF document text
  • https://zinejimi.weebly.com/uploads/1/4/1/2/141249652/tuzutuku.pdfIn PDF document text
  • https://kujofajatoniw.weebly.com/uploads/1/3/1/4/131406813/mizijepa_kepedojebizenok_wogixo_fusezivu.pdfIn PDF document text
  • https://juvirafiwak.weebly.com/uploads/1/3/4/3/134307718/dofonutepeluk.pdfIn PDF document text
  • https://tonulolini.weebly.com/uploads/1/3/4/3/134341491/755183.pdfIn PDF document text
  • http://waterlootour.com/FileData/ckfinder/files/20220408_78FD23B1DBE2BCDD.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0004a3b6.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0004a3b6.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.