Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://yubit.co.za/XSRYdR1H?utm_term=klasifikasi+space+maintainer+pdf+free+online+file+editor PDF link annotation

  • https://muniwosurixuz.weebly.com/uploads/1/4/1/3/141337590/zisir.pdfIn PDF document text
  • https://pejomanizo.weebly.com/uploads/1/4/1/4/141496561/6512812.pdfIn PDF document text
  • https://wulidinuwiniz.weebly.com/uploads/1/3/5/3/135326152/717e364a63d04.pdfIn PDF document text
  • https://luxury77.com/kcfinder/upload/files/57673261582.pdfIn PDF document text
  • https://suruvimaweluza.weebly.com/uploads/1/3/4/1/134131456/4985183.pdfIn PDF document text
  • http://salonlomi.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16264f718d26bf---tukunorufaxu.pdfIn PDF document text
  • https://nulazonale.weebly.com/uploads/1/3/4/8/134892754/200ad019a831ef9.pdfIn PDF document text
  • https://zosesudemosovar.weebly.com/uploads/1/3/4/8/134865665/5299218.pdfIn PDF document text
  • http://bep-a-cong-nghiep.theonejsc.com/userfiles/file/31324694218.pdfIn PDF document text
  • http://buyuksahinbeyasm.com/depo/files/mividebutamajug.pdfIn PDF document text
  • https://wosubazaroden.weebly.com/uploads/1/3/0/8/130813518/29bc67b1f0a6089.pdfIn PDF document text
  • https://munujagafunudo.weebly.com/uploads/1/3/0/8/130873736/9870026.pdfIn PDF document text
  • https://lexigeme.weebly.com/uploads/1/3/4/5/134524735/9e4fb89c.pdfIn PDF document text
  • https://kofekatemate.weebly.com/uploads/1/3/2/8/132815318/jofotedad.pdfIn PDF document text
  • https://sizasaligibi.weebly.com/uploads/1/3/4/5/134506534/427f7bd.pdfIn PDF document text
  • https://gelavunojojudon.weebly.com/uploads/1/3/5/3/135390257/jarekoze.pdfIn PDF document text
  • https://wetogukonitama.weebly.com/uploads/1/3/3/9/133997956/7d29fb9c25081f4.pdfIn PDF document text
  • https://jonolepazom.weebly.com/uploads/1/3/4/5/134520471/627a9cebd2923.pdfIn PDF document text
  • http://vladekoservis.ru/files/fawaraputefefikojeviwede.pdfIn PDF document text
  • https://wikaxefukefep.weebly.com/uploads/1/3/4/5/134519338/6957642.pdfIn PDF document text
  • https://kevifuzokidoku.weebly.com/uploads/1/3/5/3/135310888/manakof_vuvalidanuni.pdfIn PDF document text
  • http://axwelindia.com/uploads/xojit.pdfIn PDF document text
  • http://poliman.srv.br/assets/kcfinder/upload/files/gajofejezadedujowu.pdfIn PDF document text
  • http://soles2walk.cz/data/file/nunelurazijujaza.pdfIn PDF document text
  • http://www.bestofasco.cz/upload/files/lopiniroruxokuzo.pdfIn PDF document text
  • https://paviliwele.weebly.com/uploads/1/3/4/4/134489687/1458930.pdfIn PDF document text
  • https://detectagsafety.com/ckfinder/userfiles/files/91489466512.pdfIn PDF document text
  • https://chambres-hotes-aube-bleue.fr/userfiles/file/84956253500.pdfIn PDF document text
  • https://dobski.pl/userfiles/file/ratilegusisoranowuzek.pdfIn PDF document text
  • https://vivantinvest.nl/userfiles/file/31368492493.pdfIn PDF document text
  • https://wefafidopomaxet.weebly.com/uploads/1/4/1/5/141524100/zagorimalel.pdfIn PDF document text
  • https://xigajowe.weebly.com/uploads/1/4/1/3/141368187/8575659.pdfIn PDF document text
  • https://mawakizuk.weebly.com/uploads/1/3/0/7/130775730/4338c36ea2d0675.pdfIn PDF document text
  • http://mps-india.com/userfiles/files/17943992002.pdfIn PDF document text
  • http://glampingcaravan.com/userfiles/file/20220427024842.pdfIn PDF document text
  • https://doanhnghiepvietnam.niengiamdoanhnghiep.vn/img_duhoc/files/ragirezafonedivizogik.pdfIn PDF document text
  • https://nagafijobe.weebly.com/uploads/1/3/4/6/134621550/69ccafb81c64d2.pdfIn PDF document text
  • http://studiotecnicoforace.eu/userfiles/files/zovarezuvumibipomegep.pdfIn PDF document text
  • https://xilemuje.weebly.com/uploads/1/3/4/2/134265988/lakolasej.pdfIn PDF document text
  • https://waxparadise.pl/userfiles/file/jabojopubosat.pdfIn PDF document text
  • http://tsg-vaganovskoe.ru/ckfinder/userfiles/files/dipofenumefudewagoneboze.pdfIn PDF document text
  • https://nobiramiw.weebly.com/uploads/1/3/4/4/134403563/311bc2d236.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000261b7.bin)

  +1 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.