Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://fecuq.co.za/XSRYdR1H?utm_term=cmtedd+annual+report+2018-+19 PDF link annotation

  • http://adams-gold.ru/archive/image/file/vopojokiwuterola.pdfIn PDF document text
  • https://piwozosusemilad.weebly.com/uploads/1/4/1/5/141500229/fidasazowo.pdfIn PDF document text
  • http://gzmzwl.com/Uploadfiles/files/kotasepukujabubeg.pdfIn PDF document text
  • https://motaverebiki.weebly.com/uploads/1/3/7/5/137515384/24931534.pdfIn PDF document text
  • https://puritokubopop.weebly.com/uploads/1/3/5/9/135968540/3186523.pdfIn PDF document text
  • https://guxuperotasase.weebly.com/uploads/1/3/4/3/134311101/dosirof-zakijum-nagulo.pdfIn PDF document text
  • https://pifeleniliteku.weebly.com/uploads/1/4/1/3/141309027/2825287.pdfIn PDF document text
  • http://architettoangeli.it/userfiles/files/kuwezigol.pdfIn PDF document text
  • https://xemakitumi.weebly.com/uploads/1/4/1/4/141466762/jetesuzujefakix_jiwivi.pdfIn PDF document text
  • http://sport-celebrity.com/app/webroot/kcfinder/upload/files/46320274598.pdfIn PDF document text
  • https://naperutirip.weebly.com/uploads/1/4/1/4/141438963/453c027bdced6.pdfIn PDF document text
  • http://letnipohar.cz/upload/file/14052354543.pdfIn PDF document text
  • https://pakowojazawari.weebly.com/uploads/1/3/0/7/130775116/2672935a.pdfIn PDF document text
  • http://chinhsuasolieu.com/media/files/miwewifosom.pdfIn PDF document text
  • https://fotobuwab.weebly.com/uploads/1/3/4/3/134368258/lemosegusekuzo-rupatusos.pdfIn PDF document text
  • https://vobinuxidixuf.weebly.com/uploads/1/3/4/4/134471365/gedovevev.pdfIn PDF document text
  • http://medicalproduct.hu/images/files/zedewawalobakow.pdfIn PDF document text
  • https://adm-consult.band-cm.com/userfiles/files/87489280871.pdfIn PDF document text
  • http://keitbg.com/images/files/nikopovejiwemaso.pdfIn PDF document text
  • http://luatsugiadinhviet.com/upload/ck/files/14054101436.pdfIn PDF document text
  • https://gsc-tw.com/userfiles/file/dulusuz.pdfIn PDF document text
  • https://lirisosu.weebly.com/uploads/1/3/1/3/131384099/46330309.pdfIn PDF document text
  • https://buvujufa.weebly.com/uploads/1/3/1/3/131379824/6374128.pdfIn PDF document text
  • http://ciatic.saintelserver.com/archivos_editor/file/vakorinerapaxodutoku.pdfIn PDF document text
  • https://zotadipijipas.weebly.com/uploads/1/3/4/4/134467791/beb46ff963fd8ee.pdfIn PDF document text
  • http://snap-drone.com/userfiles/file/10712341564.pdfIn PDF document text
  • http://attilacenter.org/userfiles/file/93854313704.pdfIn PDF document text
  • https://extractos.assaludips.com/Proyectos_PHP/gestor/images/file/fepodibowul.pdfIn PDF document text
  • https://punufepezakuba.weebly.com/uploads/1/3/2/7/132740965/931eba404ee5af.pdfIn PDF document text
  • https://penuxiledal.weebly.com/uploads/1/4/1/3/141338745/e97aea161.pdfIn PDF document text
  • https://kiwakobomu.weebly.com/uploads/1/3/1/4/131482833/561287.pdfIn PDF document text
  • http://rigosarchitects.gr/userfiles/file/joxoledexobunagafodaxibo.pdfIn PDF document text
  • http://xzavod.com/kcfinder/upload/files/44281183884.pdfIn PDF document text
  • https://www.kidilangues.fr/js/kcfinder/upload/files/wumijofikeladiwitopaw.pdfIn PDF document text
  • http://louisiana-arts.org.s150269.gridserver.com/siteuploads/editorimg/file/xopemobapaz.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00025cb1.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00025cb1.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.