Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://sunuf.co.za/XSRYdR1H?utm_term=acordes+para+guitarra+canciones+faci PDF link annotation

  • https://cian.hr/userfiles/file/60410376937.pdfIn PDF document text
  • https://familienbilstrup.dk/ckfinder/userfiles/files/53572986762.pdfIn PDF document text
  • https://thebottombillion.org/business_school/uploads/file/fidojitazoludiguzawax.pdfIn PDF document text
  • http://selfmadefilms.nl/userfiles/files/mawitatusavu.pdfIn PDF document text
  • https://arichaindia.com/userfiles/file/gimebev.pdfIn PDF document text
  • https://www.nasasquirrel.org/kcfinder/upload/files/96053378111.pdfIn PDF document text
  • http://part-service55.ru/kcfinder/upload/files/bawefivokel.pdfIn PDF document text
  • https://hylyt.co/wp-content/plugins/super-forms/uploads/php/files/f716ff62f0dade473d06cb1ff288cebb/fuboxonavotumidufid.pdfIn PDF document text
  • http://tehnaplus.mk/tehnaplus/kcfinder/upload/files/kuvazi.pdfIn PDF document text
  • https://www.bilasiparacollege.org/assets/kcfinder/upload/files/31590061417.pdfIn PDF document text
  • https://www.oceaniacroisieres.com/html/scripts/ckeditor/kcfinder/upload/files/3535373799.pdfIn PDF document text
  • https://casacresques.cat/uploads/files/44784597648.pdfIn PDF document text
  • http://derkwoo.com/upload/editor/files/norifunumezisugedupajazir.pdfIn PDF document text
  • https://www.cbrn.tj/nrsa_system/ckeditor/kcfinder/upload/files/fudosab.pdfIn PDF document text
  • http://dragoniresorts.com/userfiles/85039492071.pdfIn PDF document text
  • https://simplehome.ro/ckfinder/userfiles/files/rutumi.pdfIn PDF document text
  • http://infas.cz/images/wiswig/file/rugerusotokuradolekut.pdfIn PDF document text
  • http://myoffice2561.sesao33.net/UserFiles/File/dubefilufaferekupa.pdfIn PDF document text
  • https://zbmbudomont.pl/userfiles/file/1426218780.pdfIn PDF document text
  • http://metabolitplus.ru/files/file/59460202066.pdfIn PDF document text
  • https://sieuthimayphat.com/ckfinder/userfiles/files/gixodew.pdfIn PDF document text
  • http://ttlengenharia.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16200a400c60cd---gewofeka.pdfIn PDF document text
  • http://euro-service.org/kcfinder/upload/images/dedavenizuzexovidifufux.pdfIn PDF document text
  • https://mb-classic-service.de/userfiles/file/82962279179.pdfIn PDF document text
  • http://okna-stv.ru/userfiles/files/fikij.pdfIn PDF document text
  • http://ninda.vn/userfiles/files/85146381241.pdfIn PDF document text
  • http://charolais-hessen.de/write/userfiles/file/bakenezuniguzadawab.pdfIn PDF document text
  • https://agriturismoilcolle.org/userfiles/file/55397981099.pdfIn PDF document text
  • https://misbahelmudii.org/ckfinder/userfiles/files/dotove.pdfIn PDF document text
  • http://italiangreyhound.pl/img1/userfiles/file/5422463985.pdfIn PDF document text
  • http://obraz-tlt.ru/userfiles/file/nekazizogulomotuxate.pdfIn PDF document text
  • https://acp-luxusingatlanok.hu/ckfinder/userfiles/files/wememogurarezobun.pdfIn PDF document text
  • http://tungalag.mn/userfiles/files/kolozefufedosotaremokurep.pdfIn PDF document text
  • https://plumcourse.com/wp-content/plugins/super-forms/uploads/php/files/c580999b6c14933cea3e625ec72b12f0/jonenewulafiroxezak.pdfIn PDF document text
  • https://www.yoursurveysurveyors.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/162308c3ef041c---59592532097.pdfIn PDF document text
  • http://www.yourhealthyourchoice.org/wp-content/plugins/formcraft/file-upload/server/content/files/1622ec0066ecad---83292956612.pdfIn PDF document text
  • https://rlmahtani.com/userfiles/files/28870434751.pdfIn PDF document text
  • http://elt-tm.uz/kcfinder/upload/files/nodolarofovadab.pdfIn PDF document text
  • https://ceb.lk/assets/js/kcfinder/upload/files/goromeribatev.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00041d1e.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00041d1e.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.