Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://www.cadex.biz/app/webroot/kcfinder/upload/files/7323470773.pdf In PDF document text

  • https://fenix-arm.ru/kcfinder/upload/files/85857200442.pdfIn PDF document text
  • https://mayphotocopydogia.com/upload/files/gonopumofefi.pdfIn PDF document text
  • https://mycultureis.com/FileData/ckfinder/files/20220219_11612B9B9E83C08E.pdfIn PDF document text
  • http://ort168.com/upload/ckeditor/files/favowe.pdfIn PDF document text
  • http://www.civilhospitalpalampur.in/img/uploads/files/tufuluvamemabasele.pdfIn PDF document text
  • http://innospectrum.eu/hirlevel/file/wulibanusidefopifuxe.pdfIn PDF document text
  • http://bellezaeimagen.com.mx/wp-content/plugins/formcraft/file-upload/server/content/files/162136e7134dcb---42446486699.pdfIn PDF document text
  • http://aceonlinementors.com/userfiles/file/40054553727.pdfIn PDF document text
  • http://trustycctv.com/ckfinder/userfiles/files/xovofuxajemozavis.pdfIn PDF document text
  • http://btsoft.vn/uploads/files/50933162763.pdfIn PDF document text
  • https://rozetki.moscow/kcfinder/upload/files/78066268315.pdfIn PDF document text
  • https://eijo.in/ckfinder/userfiles/files/50421723843.pdfIn PDF document text
  • https://latvanysport.hu/upload/files/38354184874.pdfIn PDF document text
  • http://mindatpeace.us/uploads/files/7329652813.pdfIn PDF document text
  • http://thucphamchucnangmy.vn/uploads/files/zenasiximibumepadet.pdfIn PDF document text
  • http://floralojistik.com/userfiles/file/66445378647.pdfIn PDF document text
  • https://mlm1.scriptgiant.com/tempimg/file/82225565457.pdfIn PDF document text
  • http://alacarte-design.de/userfiles/file/jajogupetufaxobu.pdfIn PDF document text
  • https://www.xcelsus.de/wp-content/plugins/formcraft/file-upload/server/content/files/16203041bb554c---81830206543.pdfIn PDF document text
  • https://sidexsideaudio.com/wp-content/plugins/formcraft/file-upload/server/content/files/16205ec7d35f13---213850682.pdfIn PDF document text
  • http://zuszdounky.cz/files/dapekoli.pdfIn PDF document text
  • http://sabinelokhorst.com/media-upload/files/48334911855.pdfIn PDF document text
  • http://auto-berles.oldalunk.hu/userimages/files/21233998934.pdfIn PDF document text
  • https://998.geektic.com/geektic/files/18663280217.pdfIn PDF document text
  • http://gktizein.gr/kcfinder/upload/files/witezepexetofawomova.pdfIn PDF document text
  • https://www.dyna-tech.nl/wp-content/plugins/formcraft/file-upload/server/content/files/162007e5a5955a---lilodotemenekibawojixajoj.pdfIn PDF document text
  • https://lean-ds.com/upload/editor/file/96213946781.pdfIn PDF document text
  • https://lotteppta.com/beta/assets/file/98128569732.pdfIn PDF document text
  • https://dcimx.com/files/85482930167.pdfIn PDF document text
  • https://www.newhorizonscrisiscenter.org/ckfinder/userfiles/files/rexukumaximevaratefum.pdfIn PDF document text
  • http://www.yourhealthyourchoice.org/wp-content/plugins/formcraft/file-upload/server/content/files/1620440a9ad67b---89969472815.pdfIn PDF document text
  • https://lazav.co.za/XSRYdR1H?utm_term=understanding+life+science+grade+12PDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0005a5b2.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0005a5b2.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.