Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
  Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
• PDF advertises pirated movie streaming/download medium PDF_PIRACY_STREAMING_LURE
  PDF rendered text advertises free full-movie streaming or download using piracy-brand names or a 'full movie + download/free/watch' intent phrase — recovered after folding the styled Unicode confusables the campaign uses to hide those keywords from plain-text detection. These are disposable SEO-spam carriers that route users to malvertising, fake-player, and scam pages; the PDF itself is inert.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://woronawupewusor.weebly.com/uploads/1/3/4/6/134672267/pawebaj_fugopabipulapi_tagifamemabarew_riwofun.pdf In PDF document text

  • https://narokijobuwixe.weebly.com/uploads/1/3/4/7/134738868/1800079.pdfIn PDF document text
  • http://topopentertainment.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621c372ec1914---5010876301.pdfIn PDF document text
  • https://gomujivas.weebly.com/uploads/1/3/5/3/135321586/7313132.pdfIn PDF document text
  • https://sivipafegedijog.weebly.com/uploads/1/3/4/4/134443607/murobedifedonefatos.pdfIn PDF document text
  • https://dojumavuj.weebly.com/uploads/1/3/3/9/133997280/boparewus.pdfIn PDF document text
  • https://thegmsbihta.eruditiontech.com/userfiles/file/85981391580.pdfIn PDF document text
  • https://ligunoko.weebly.com/uploads/1/3/4/3/134308404/8310e7abe.pdfIn PDF document text
  • https://xamoleluwu.weebly.com/uploads/1/4/1/3/141365820/b89f9e640005.pdfIn PDF document text
  • http://fzsvybbs.at/userfiles/file/fetaxereniwigefikuremo.pdfIn PDF document text
  • https://pegemogavabupaz.weebly.com/uploads/1/3/4/3/134310843/wezuwes.pdfIn PDF document text
  • https://besabowedevu.weebly.com/uploads/1/4/1/3/141398353/pesuzis-robegokoda-fazaxitofegabof.pdfIn PDF document text
  • https://tewetabegide.weebly.com/uploads/1/4/2/1/142138929/jafepometuvopojiki.pdfIn PDF document text
  • https://foworagajiwodim.weebly.com/uploads/1/3/0/9/130969946/zovijufidev.pdfIn PDF document text
  • https://coffotea.com/uploads/files/202202021708557198.pdfIn PDF document text
  • https://weblative.com/wp-content/plugins/super-forms/uploads/php/files/p95n3d57kvd0t48k7g4mdh1qgi/rejadobifufokatap.pdfIn PDF document text
  • https://gitapelo.weebly.com/uploads/1/3/2/6/132682700/pusalegikopineji.pdfIn PDF document text
  • https://sazomazijuxo.weebly.com/uploads/1/3/4/5/134522077/japelavabufulukugite.pdfIn PDF document text
  • https://gratuit.kidilangues.fr/js/kcfinder/upload/files/20334785845.pdfIn PDF document text
  • https://dejuxowiku.weebly.com/uploads/1/3/0/7/130738850/e135698f839.pdfIn PDF document text
  • https://sunanineriputa.weebly.com/uploads/1/3/2/7/132740954/mizuvasizuwebus-dewizobenupexew-ditonu.pdfIn PDF document text
  • https://fukaxoxatu.weebly.com/uploads/1/3/1/4/131438517/degusosavafo.pdfIn PDF document text
  • https://pipawini.weebly.com/uploads/1/3/4/8/134888109/4972759.pdfIn PDF document text
  • http://cybertourthailand.com/bot/ckfinder/uf/files/nemarilevilarifibul.pdfIn PDF document text
  • http://travellerisland.com/files/zaxatuje.pdfIn PDF document text
  • https://nalafefig.weebly.com/uploads/1/3/1/3/131379301/6387350.pdfIn PDF document text
  • https://satiragekawojiw.weebly.com/uploads/1/3/2/7/132740750/zexel.pdfIn PDF document text
  • https://siemens-rozetki.ru/kcfinder/upload/files/xisepewiridoxo.pdfIn PDF document text
  • http://sns-russia.ru/userfiles/file/60031875586.pdfIn PDF document text
  • https://www.tri-or.fr/tri-or/ckfinder/userfilesfiles/43987220169.pdfIn PDF document text
  • https://kerutefabiwemek.weebly.com/uploads/1/3/0/8/130874269/2878380.pdfIn PDF document text
  • http://basketaci.cz/UserFiles/File/jabizawikepikovezetidep.pdfIn PDF document text
  • https://nidijudaxodefep.weebly.com/uploads/1/4/1/7/141742744/mivivupo.pdfIn PDF document text
  • http://irodaszer.lukinserv.hu/file/bugiturorotalot.pdfIn PDF document text
  • http://yh-nutri.com/filespath/files/20220301030026.pdfIn PDF document text
  • https://destination.irinadempsey.ru/userfiles/file/noridimidotegigarosi.pdfIn PDF document text
  • http://smcertificationservices.com/userfiles/files/34270193132.pdfIn PDF document text
  • https://vorexumezekadan.weebly.com/uploads/1/3/0/9/130969740/subolukuwox_kowotije_vorasupexubawi.pdfIn PDF document text
  • https://profbuhotchet.ru/wp-content/plugins/super-forms/uploads/php/files/6e1f9257afeab03169ae19c0ef94831b/24881537832.pdfIn PDF document text
  • https://dojidawirizuj.weebly.com/uploads/1/4/1/5/141593499/4374029.pdfIn PDF document text
  • https://lorotemorotur.weebly.com/uploads/1/3/4/6/134649447/kenoguzevufem_dulikerinavu.pdfIn PDF document text
  • https://rodefakuwutepez.weebly.com/uploads/1/3/4/3/134341390/tunadoxaxamut_mawosegolan.pdfIn PDF document text
  • http://hoclaixebinhthuan.com/upload/contentFile/file/25714922244.pdfIn PDF document text
  • http://www.skupp.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16222866b9929e---padusifokoxanuj.pdfIn PDF document text
  • https://gufonesugoxemi.weebly.com/uploads/1/3/5/9/135960051/gifav.pdfIn PDF document text
  • https://jivekale.weebly.com/uploads/1/3/4/3/134319103/1201974.pdfIn PDF document text
  • https://fugopezawisobib.weebly.com/uploads/1/3/1/3/131383650/libun.pdfIn PDF document text
  • https://kajemawukik.weebly.com/uploads/1/3/4/5/134589491/pavutajoladugeza.pdfIn PDF document text
  • http://festivaldeliteraturadepereira.com/wp-content/plugins/formcraft/file-upload/server/content/files/1624bd0b980ea8---99344579796.pdfIn PDF document text
  • https://fecuq.co.za/XSRYdR1H?utm_term=the+girl+on+the+train+pdf+online+pdf+download+torrentPDF link annotation

  +9 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.