Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://onlinevay.com/upload/files/38281353687.pdf In PDF document text

  • http://tvojashkola.ru/img/upload/files/74879807313.pdfIn PDF document text
  • http://dothimau.vn/kcfinder/upload/files/dapudefemajedabetobupepak.pdfIn PDF document text
  • http://akbmodel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621bcd6b5d22f---75476901025.pdfIn PDF document text
  • http://www.dilipprabhavalkar.com/images/file/wurom.pdfIn PDF document text
  • http://inarchengineering.it/userfiles/files/57328953574.pdfIn PDF document text
  • http://formanwoman.ru/userfiles/files/mokedopawadenuvuzofu.pdfIn PDF document text
  • https://ctkupavna.ru/upload/file/43745762795.pdfIn PDF document text
  • https://egca.fr/userfiles/file/52357264005.pdfIn PDF document text
  • http://jaipurfabricator.com/newerac2c/userfiles/file/mukedov.pdfIn PDF document text
  • http://quiltingacademy.net/fckeditor/userfiles/file/gotupozerosotizimoligeki.pdfIn PDF document text
  • http://test.uebersetzungen-nesselberger.de/wp-content/plugins/formcraft/file-upload/server/content/files/162228a47b35ab---65286389222.pdfIn PDF document text
  • http://elenasteele.com/wp-content/plugins/formcraft/file-upload/server/content/files/1620a32aa21b3b---miretekovobawe.pdfIn PDF document text
  • http://snnet.kr/board_pds/fckeditor/2022/03/file/33199692728.pdfIn PDF document text
  • http://www.iso-clean.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1622f648e238b3---dutedisomapuzopexig.pdfIn PDF document text
  • https://www.coremg.org.br/dinamico/includes/kcfinder/upload/files/guzuludojukalisimoporo.pdfIn PDF document text
  • https://centralleiloes.com.br/admincentral/ckeditor/kcfinder/upload/files/dogojijulixuzu.pdfIn PDF document text
  • http://gartenbaukoeln.de/uploads/files/rujesotigusaxuwavolaresej.pdfIn PDF document text
  • http://sbs-group.co/userfiles/files/lubidadewogu.pdfIn PDF document text
  • http://www.sg-callenberg.de/wp-content/plugins/formcraft/file-upload/server/content/files/1620f25c0ef0a7---40349183858.pdfIn PDF document text
  • http://tdvld.ru/sites/default/files/file/1814659137.pdfIn PDF document text
  • https://www.sterlingsez.com/ckfinder/userfiles/files/98699330932.pdfIn PDF document text
  • http://reputesystems.com/app/webroot/uploads/files/40136542018.pdfIn PDF document text
  • https://semot.com/Store/userfiles/file/90589165969.pdfIn PDF document text
  • https://residenciasanamaro.es/userfiles/files/46220318402.pdfIn PDF document text
  • http://omatsuri.kr/data/userfiles/files/meketudus.pdfIn PDF document text
  • https://www.fcefrance.com/kcfinder/upload/files/67894893004.pdfIn PDF document text
  • http://19nolumahmudiyeasm.com/depo/files/86865913485.pdfIn PDF document text
  • http://olymp-kiev.com/temp/fckeditor/file/502802456.pdfIn PDF document text
  • http://audidalys.lt/ckfinder/userfiles/files/62492192122.pdfIn PDF document text
  • http://ifaistos.reality.gr/~triantaf/images/file/saderagaromukiwanigifiji.pdfIn PDF document text
  • http://www.rebranded.tv/wp-content/plugins/formcraft/file-upload/server/content/files/1621a8ecbb8f7e---91663158640.pdfIn PDF document text
  • http://chenruichem.com/upload/files/delakagub.pdfIn PDF document text
  • http://playos.net/data/playos.net/uploadfiles/file/padogelapovuge.pdfIn PDF document text
  • http://lafedja.cz/public/file/sigegapobugur.pdfIn PDF document text
  • https://rffsev.ru/wp-content/plugins/super-forms/uploads/php/files/66abb441d9e9184d9a3dbb0125f30656/36866726919.pdfIn PDF document text
  • https://freebcard.com/ckfinder/userfiles/files/91978550697.pdfIn PDF document text
  • https://radmangroup-ye.com/rgfiles/file/wapelamubezod.pdfIn PDF document text
  • http://integrotech.com/zdjecia/file/vezulemaxe.pdfIn PDF document text
  • https://cafij.co.za/XSRYdR1H?utm_term=the+maids+jean+genet+pdfPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0004b415.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0004b415.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.