Malicious PDF — malware analysis report

Heuristics 8

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
  PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Embedded JS stream low PDF_JS
  PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://tevav.co.za/XSRYdR1H?utm_term=dj+bass+system PDF link annotation

  • http://chronocertif.com/userfiles/file/kamoxutofewivigeg.pdfIn PDF document text
  • https://aep-tc.com/cache/fck_files/file/15033071933.pdfIn PDF document text
  • http://studioarclab.eu/userfiles/files/84715871865.pdfIn PDF document text
  • https://galerieportelouise.be/userfiles/files/wazuvowazidumenijonip.pdfIn PDF document text
  • https://universal4shipping.net/userfiles/file/11672172698.pdfIn PDF document text
  • http://www.cenlajobinator.com/siteuploads/editorimg/file/96441760561.pdfIn PDF document text
  • http://www.workbythai.com/admin/assets/images/26616996723.pdfIn PDF document text
  • http://mfcpavpos.ru/file/9886069674.pdfIn PDF document text
  • http://poaglasses.com/uploads/files/202109281800136619.pdfIn PDF document text
  • https://nutrishop.in/ci/userfiles/files/nubuzedamu.pdfIn PDF document text
  • https://wentworthre.com/wp-content/plugins/super-forms/uploads/php/files/700eb2466196dda2471e48433dee36dd/73047283498.pdfIn PDF document text
  • http://lgassociates.in/uploads/nakunofow.pdfIn PDF document text
  • http://traktor-tv.de/sites/default/files/file/febobojuridono.pdfIn PDF document text
  • http://www.oschouston.com/osc/wp-content/plugins/formcraft/file-upload/server/content/files/1612a7d6a3963f---gofufog.pdfIn PDF document text
  • http://madiran-cruduparadis.fr/ckfinder/userfiles/files/sifumozenuwib.pdfIn PDF document text
  • https://magyar-logyogyasz.hu/fileok/file/96584657163.pdfIn PDF document text
  • https://www.pianoeg.de/admin/ckeditor/kcfinder/upload/files/58093719360.pdfIn PDF document text
  • https://ahha.az/userfiles/file/tigabureb.pdfIn PDF document text
  • https://watosaphotography.com/app/webroot/userfiles/files/20210703_122734.pdfIn PDF document text
  • http://euromarkcreations.com/new/fck_img/file/2717688352.pdfIn PDF document text
  • http://tamilannuaire.com/var/www/vhosts/vps296430.ovh.net/tamilannuaire.com/images/file/76675957906.pdfIn PDF document text
  • https://luxesystem.site/js/ckfinder/userfiles/files/70183699758.pdfIn PDF document text
  • https://xn--80aaa1anac6cg.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/c5cea6fd83fba33d79fb0b5e4ae92d37/budujow.pdfIn PDF document text
  • http://www.iamgoingto1996.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e0554041095---lovisilejutujajof.pdfIn PDF document text
  • http://www.videocopilot.net/assets/public/ckfinder/userfiles/files/jesalokeziwote.pdfIn PDF document text
  • https://temporar.mirceaseminee.ro/printuri-fi/files/65797547565.pdfIn PDF document text
  • https://jjcfurnituremaker.com/userfiles/files/50888150287.pdfIn PDF document text
  • http://www.southpointinstitutehowrah.com/admin/uploads/file/96434293527.pdfIn PDF document text
  • http://goldendoodlesofthesierranevadas.com/userfiles/file/zavewusigisetowugir.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.