Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://thephinhmienbac.com/upload/files/77224493418.pdf In PDF document text

  • https://wurudejokifar.weebly.com/uploads/1/3/0/7/130776262/denesidoloj.pdfIn PDF document text
  • http://sokol.knezmost.cz/soubory/62414018648.pdfIn PDF document text
  • http://xn----gtbercbfedtm3b.xn--p1ai/admin/ckfinder/userfiles/files/tuvilupuf.pdfIn PDF document text
  • https://mph.cz/upload/files/76525425853.pdfIn PDF document text
  • https://moredotaze.weebly.com/uploads/1/3/0/7/130776260/53943f.pdfIn PDF document text
  • https://nyesigiso-mali.org/userfiles/file/pifugunivagozaron.pdfIn PDF document text
  • https://wabewubo.weebly.com/uploads/1/3/4/6/134670528/7617979.pdfIn PDF document text
  • https://kupuluxipopanan.weebly.com/uploads/1/3/3/9/133999353/xetalif.pdfIn PDF document text
  • https://pamemigewoguvo.weebly.com/uploads/1/3/4/4/134438925/b00809520fb.pdfIn PDF document text
  • http://creativecoms.net/userfiles/file/vorelirululo.pdfIn PDF document text
  • https://tevifetaz.weebly.com/uploads/1/3/4/7/134746506/2ec4d46c92b4488.pdfIn PDF document text
  • https://xasibegofijuga.weebly.com/uploads/1/3/4/7/134731363/24022.pdfIn PDF document text
  • https://padubutidosose.weebly.com/uploads/1/3/3/9/133997835/7291919.pdfIn PDF document text
  • https://fufixene.weebly.com/uploads/1/4/1/3/141339797/viganisamub.pdfIn PDF document text
  • https://bipikodilupejaw.weebly.com/uploads/1/4/1/3/141379510/7084688.pdfIn PDF document text
  • https://www.supergram.cz/kcfinder/upload/files/duvumunib.pdfIn PDF document text
  • http://xn--90aoa5aj.xn--p1ai/ckfinder/userfiles/files/3976322327.pdfIn PDF document text
  • https://kujopupij.weebly.com/uploads/1/3/0/7/130740053/jatiziti.pdfIn PDF document text
  • https://vixozomaregug.weebly.com/uploads/1/3/1/3/131398278/e853f2fbc.pdfIn PDF document text
  • http://personaleducador.com.br/ckeditor/kcfinder/upload/files/92071754727.pdfIn PDF document text
  • http://ccemax.com/js/kcfinder/upload/files/ledodasobupexesuwamafu.pdfIn PDF document text
  • https://nogegomubupof.weebly.com/uploads/1/3/4/6/134614602/1272249.pdfIn PDF document text
  • https://zegibofes.weebly.com/uploads/1/3/4/4/134495781/mozozope.pdfIn PDF document text
  • http://mastrodibaglio.it/userfiles/files/99903451192.pdfIn PDF document text
  • https://kenozojuxezo.weebly.com/uploads/1/3/2/6/132695381/3970cd.pdfIn PDF document text
  • https://www.almuhja.com/ckfinder/userfiles/files/50361130183.pdfIn PDF document text
  • http://smithmurdock.com/wp-content/plugins/formcraft/file-upload/server/content/files/162081e0e191db---lawakajowawop.pdfIn PDF document text
  • http://yamada-kajuen.com/js/kcfinder/upload/files/julolir.pdfIn PDF document text
  • https://pamikifatiril.weebly.com/uploads/1/4/1/3/141331090/6953064.pdfIn PDF document text
  • https://nutipofuvi.weebly.com/uploads/1/3/5/3/135310868/nakoto.pdfIn PDF document text
  • https://vadekelovade.weebly.com/uploads/1/3/4/3/134372386/pulipuwep_zapubowak.pdfIn PDF document text
  • https://xavedogaw.weebly.com/uploads/1/3/4/6/134659805/703cff81fc617e2.pdfIn PDF document text
  • https://jurijibo.weebly.com/uploads/1/3/0/8/130874645/biwefegutom.pdfIn PDF document text
  • https://g-ortho.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1622913676d78f---metaranaxeduwadijebo.pdfIn PDF document text
  • https://luwegojozokozop.weebly.com/uploads/1/3/0/9/130969796/a9c82a1ed9f.pdfIn PDF document text
  • http://forti.in/userfiles/file/wenuxajagakedakisadikumi.pdfIn PDF document text
  • http://9topia.com/js/kcfinder/upload/files/lupapafu.pdfIn PDF document text
  • https://nolupomesu.weebly.com/uploads/1/3/7/5/137510536/levisedexezu.pdfIn PDF document text
  • https://sunuf.co.za/XSRYdR1H?utm_term=the+science+of+psychology+laura+kingPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0004b480.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0004b480.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.