Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://limopepubev.weebly.com/uploads/1/3/4/6/134627214/duvomikirorot_degabozabatogev.pdf In PDF document text

  • https://jubuxazule.weebly.com/uploads/1/3/4/5/134585976/c72ffb.pdfIn PDF document text
  • https://lolugijil.weebly.com/uploads/1/4/1/3/141343065/wudixupizetex-simefarizesepe-pukex-lebap.pdfIn PDF document text
  • http://e-motyle.natura2000.pl/imgturysta/files/nixuron.pdfIn PDF document text
  • https://zumaninerotuz.weebly.com/uploads/1/3/1/6/131637595/42aa5d7.pdfIn PDF document text
  • https://tifowufiwadoxi.weebly.com/uploads/1/3/4/0/134098290/sipuruderoribep.pdfIn PDF document text
  • https://kuregemivak.weebly.com/uploads/1/4/1/2/141283166/vupisejonenavunapoju.pdfIn PDF document text
  • https://mekesenewinev.weebly.com/uploads/1/3/4/2/134234563/kofidukeni.pdfIn PDF document text
  • https://dimagusideno.weebly.com/uploads/1/4/1/3/141374986/1557315.pdfIn PDF document text
  • https://sajejedazo.weebly.com/uploads/1/3/3/9/133999783/3c44e634d4.pdfIn PDF document text
  • https://vavaxurose.weebly.com/uploads/1/3/0/7/130775274/ce5ca85f2e03.pdfIn PDF document text
  • https://zamigemunizi.weebly.com/uploads/1/3/4/3/134347724/dewumalanamavudit.pdfIn PDF document text
  • https://xozipirun.weebly.com/uploads/1/3/5/3/135324749/9af92356d93.pdfIn PDF document text
  • https://netcsemege.elelmiszer-hazhozszallitas.hu/ckfinder/userfiles/files/22435378464.pdfIn PDF document text
  • https://baduripafab.weebly.com/uploads/1/3/4/6/134623558/jijevonogamoxu.pdfIn PDF document text
  • https://rabepifisusix.weebly.com/uploads/1/3/4/8/134881283/pofad.pdfIn PDF document text
  • https://niwupusig.weebly.com/uploads/1/3/1/4/131438062/muzezu_soguxasividoro_dezin_jorelowenuf.pdfIn PDF document text
  • https://nifusesoporiw.weebly.com/uploads/1/3/5/3/135309858/rofusevusaxow_xamepigonazudu_taxekitururojaf.pdfIn PDF document text
  • https://zudomizat.weebly.com/uploads/1/3/5/3/135308615/9118993.pdfIn PDF document text
  • https://tokegomobox.weebly.com/uploads/1/3/4/3/134314144/12d1f62b.pdfIn PDF document text
  • https://vurifupilubat.weebly.com/uploads/1/3/4/4/134495287/92716b307f.pdfIn PDF document text
  • http://satcomlink.com/userData/board/file/12756717061.pdfIn PDF document text
  • https://jiketajaw.weebly.com/uploads/1/3/4/4/134464131/tesavejumibakivon.pdfIn PDF document text
  • https://guwewekotijiz.weebly.com/uploads/1/3/4/7/134714515/zapijunavu_sumop_susezetefiwixi_tapabaworukonud.pdfIn PDF document text
  • https://wetivaxidufe.weebly.com/uploads/1/3/4/8/134891283/1125516.pdfIn PDF document text
  • https://dukazisilibe.weebly.com/uploads/1/3/4/6/134679988/2d5efd58b7be24.pdfIn PDF document text
  • https://nesavelo.weebly.com/uploads/1/3/2/3/132303009/kexewexagejin_pavupewosifu_mejoxaki.pdfIn PDF document text
  • https://sokifavobal.weebly.com/uploads/1/3/4/5/134514189/8762129.pdfIn PDF document text
  • https://mofesifejizovis.weebly.com/uploads/1/3/4/7/134749503/2877868.pdfIn PDF document text
  • https://gicz.jp/uploads/kc-uploads/tmp/files/43368325293.pdfIn PDF document text
  • https://kekuziti.weebly.com/uploads/1/4/1/2/141288921/dozirinavir.pdfIn PDF document text
  • https://yubit.co.za/XSRYdR1H?utm_term=8x12+shed+plans+materialsPDF link annotation
  • https://ladozazewuse.weebly.com/uploads/1/3/4/0/134095850/a64eaf46582.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0005989d.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0005989d.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.