Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://tevav.co.za/XSRYdR1H?utm_term=mods+para+minecraft+1.7.10+herobrine PDF link annotation

  • https://jatilupek.weebly.com/uploads/1/3/4/4/134491857/7835f8b91fca2e5.pdfIn PDF document text
  • http://associazionemillesogni.it/userfiles/files/bawejamusuz.pdfIn PDF document text
  • http://sur-mesure.kesslord.fr/upload/file/gaxegekikexo.pdfIn PDF document text
  • https://jepuderakemuso.weebly.com/uploads/1/3/4/6/134666912/4058388.pdfIn PDF document text
  • https://kalogipewaga.weebly.com/uploads/1/3/4/5/134595512/vapikavumolelu-tujopunarinoj.pdfIn PDF document text
  • https://dobivevoxopu.weebly.com/uploads/1/3/1/4/131453544/zuvatumurof_wavot_romamokiza.pdfIn PDF document text
  • https://bawapumur.weebly.com/uploads/1/3/4/4/134466187/82136.pdfIn PDF document text
  • https://guridawado.weebly.com/uploads/1/3/4/5/134578433/wawevezozij_xarofoful.pdfIn PDF document text
  • https://lodewaga.weebly.com/uploads/1/3/7/5/137518990/tulexif.pdfIn PDF document text
  • https://jezilifubi.weebly.com/uploads/1/3/4/8/134887413/82be92258c0446.pdfIn PDF document text
  • https://bazeliwelari.weebly.com/uploads/1/3/1/8/131857734/zefujuni_kivezaxuka.pdfIn PDF document text
  • https://lobigemef.weebly.com/uploads/1/3/2/3/132303116/6bc3d.pdfIn PDF document text
  • https://gafukarufigak.weebly.com/uploads/1/3/5/3/135309608/1867a8083b7.pdfIn PDF document text
  • https://wosufixojiniki.weebly.com/uploads/1/3/4/7/134720754/xumefifozamim.pdfIn PDF document text
  • https://videsotu.weebly.com/uploads/1/4/1/3/141329966/0fa4b083d94e.pdfIn PDF document text
  • https://lajutiruwogow.weebly.com/uploads/1/3/4/5/134585316/ea420dfb1bdd5bd.pdfIn PDF document text
  • http://elmiraclassiccountry.com/wp-content/plugins/super-forms/uploads/php/files/5592d41616982d54638ddfcbdbecd5b0/lofanavuputemebugu.pdfIn PDF document text
  • https://fumabufoduf.weebly.com/uploads/1/3/5/3/135313851/derimifejojanor.pdfIn PDF document text
  • https://turonobofudub.weebly.com/uploads/1/3/4/4/134463989/xodiworujuvatama.pdfIn PDF document text
  • https://pawuxadatunu.weebly.com/uploads/1/3/4/2/134266652/6951630545.pdfIn PDF document text
  • https://tijawuxegolizad.weebly.com/uploads/1/3/4/5/134597381/roxabakaj-gonaf-wadolexizide.pdfIn PDF document text
  • https://xusofudubivo.weebly.com/uploads/1/3/0/7/130775679/47ef09d4cf.pdfIn PDF document text
  • https://bixavovene.weebly.com/uploads/1/3/0/7/130775743/6423678.pdfIn PDF document text
  • https://makesagesuli.weebly.com/uploads/1/3/0/7/130740055/1397685.pdfIn PDF document text
  • https://ralirepiputup.weebly.com/uploads/1/3/4/8/134852471/kanojewejuzofob-vusumedovelo.pdfIn PDF document text
  • https://dosemawa.weebly.com/uploads/1/3/5/3/135388865/webeki_wuzeba_gutatenusosefe.pdfIn PDF document text
  • https://faraguwu.weebly.com/uploads/1/3/0/9/130969294/faguvetodakenek.pdfIn PDF document text
  • https://lorrainezammit.com/files/file/7473835602.pdfIn PDF document text
  • https://rasewaganatuk.weebly.com/uploads/1/3/4/6/134654354/galagekom.pdfIn PDF document text
  • https://funobijego.weebly.com/uploads/1/3/1/6/131636789/8497319.pdfIn PDF document text
  • https://nerisowale.weebly.com/uploads/1/3/1/4/131412290/kusivirupikozeto.pdfIn PDF document text
  • https://lodufokokafapav.weebly.com/uploads/1/3/5/3/135346761/kemesokiba_givegakekuso.pdfIn PDF document text
  • https://ganovumajovad.weebly.com/uploads/1/4/1/3/141302729/sojekubif_dodajuj_rikavasojilume.pdfIn PDF document text
  • https://wirujofijiv.weebly.com/uploads/1/3/4/5/134592393/5906319.pdfIn PDF document text
  • https://filududo.weebly.com/uploads/1/3/5/3/135390237/a403cf6c.pdfIn PDF document text
  • https://fokopudetetubuw.weebly.com/uploads/1/3/4/5/134519343/siwase.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.