Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Embedded JS stream low PDF_JS
  PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://podar.co.za/XSRYdR1H?utm_term=imax+b6ac+v2+manual+espa%C3%B1ol+pdf PDF link annotation

  • http://azs-szermierka.pl/zdjecia/fck/file/sefiramo.pdfIn PDF document text
  • http://9topia.com/js/kcfinder/upload/files/75120245701.pdfIn PDF document text
  • https://ww150003.linebot.net/upfile/files/20220317040624.pdfIn PDF document text
  • https://hoya.mobioptika.hr/UserFiles/file/68658858501.pdfIn PDF document text
  • http://www.gastroblanik.cz/upload/files/12682493613.pdfIn PDF document text
  • https://besaxujujugolu.weebly.com/uploads/1/3/0/7/130739491/3cc882c421.pdfIn PDF document text
  • http://arbigaz.com.tr/panel/kcfinder/upload/files/raxerewivi.pdfIn PDF document text
  • http://re-ezumi.com/admin/kcfinder/upload/files/nogapamuwususetovak.pdfIn PDF document text
  • https://zuzumapi.weebly.com/uploads/1/3/4/3/134344149/9dfba9426e.pdfIn PDF document text
  • http://files.ibiza-ferien.de/file/40897650458.pdfIn PDF document text
  • http://asclyziarskyklub.sk/userfiles/file/tekevijikawovale.pdfIn PDF document text
  • https://crownprolaw.cn/userfiles/Proj_Name/files/64882617790.pdfIn PDF document text
  • https://vabadagijuruka.weebly.com/uploads/1/3/1/8/131856539/felidetiwi.pdfIn PDF document text
  • http://resumesfromabove.com/userfiles/file/97679410067.pdfIn PDF document text
  • https://bimaxemafapexeb.weebly.com/uploads/1/4/1/2/141254337/luzonisafin.pdfIn PDF document text
  • http://lammermoor.net/imagenes/file/gaganixosas.pdfIn PDF document text
  • http://at1apigroup3.com/contents/files/lamuxabe.pdfIn PDF document text
  • http://muzycznescyzoryki.pl/userfiles/file/45828096859.pdfIn PDF document text
  • https://soudurelauziere.com/upload/editor/file/fiwunajevinigojow.pdfIn PDF document text
  • https://actieaanbieding.com/upload/content/files/bategibemawabix.pdfIn PDF document text
  • https://blsautomation.com/ckfinder/userfiles/files/92163550590.pdfIn PDF document text
  • https://xofusifusu.weebly.com/uploads/1/3/5/3/135312872/nufabosojerajikazowi.pdfIn PDF document text
  • https://4dapi.glg228.info/app/webroot/uploads/files/71368354947.pdfIn PDF document text
  • https://gusemotasejodab.weebly.com/uploads/1/3/2/7/132741535/todejise.pdfIn PDF document text
  • https://thuaphatlaihanoi.net/uploads/files/lamuwasojonivijolo.pdfIn PDF document text
  • http://dagmar-e.de/userfiles/file/xepofix.pdfIn PDF document text
  • https://faworufobideped.weebly.com/uploads/1/3/2/6/132682851/5794677.pdfIn PDF document text
  • http://photomoments.ru/userfiles/files/38721748570.pdfIn PDF document text
  • https://vixevugipun.weebly.com/uploads/1/3/5/3/135327752/7709135.pdfIn PDF document text
  • https://biaplan.hu/images/fck/files/girupopikegadosawa.pdfIn PDF document text
  • http://hide-bo.com/img/tmp/file/71877613715.pdfIn PDF document text
  • http://hytechplus.com/userfiles/file/36974543556.pdfIn PDF document text
  • http://herve-coiffure.ci/files/xamoga.pdfIn PDF document text
  • https://zenefuzivoxog.weebly.com/uploads/1/3/4/1/134108933/seweno.pdfIn PDF document text
  • https://keguvetazako.weebly.com/uploads/1/3/4/7/134702613/d8f03.pdfIn PDF document text
  • https://lobubanir.weebly.com/uploads/1/3/2/8/132814664/tosarakimifoloka.pdfIn PDF document text
  • https://dursunguney.com/userfiles/files/74585330808.pdfIn PDF document text
  • https://mufepubawitig.weebly.com/uploads/1/3/4/6/134614790/kesetakurikit.pdfIn PDF document text
  • https://tezerwatch.com/file/upload/files/03-14-21-08-03-91.pdfIn PDF document text
  • https://pojajowose.weebly.com/uploads/1/3/0/8/130813819/c6d56128b5231.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.