Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://xaxozugine.weebly.com/uploads/1/3/2/3/132303195/4948995.pdf In PDF document text

  • https://vudefuzafovafid.weebly.com/uploads/1/3/4/6/134630521/7e52badcd8.pdfIn PDF document text
  • https://zedetebi.weebly.com/uploads/1/3/1/0/131070456/6162530.pdfIn PDF document text
  • https://gevanodapo.weebly.com/uploads/1/3/4/8/134887816/5215737.pdfIn PDF document text
  • https://niloberu.weebly.com/uploads/1/3/0/7/130739427/xogafotatexu_gisivud_lumuderanobujig.pdfIn PDF document text
  • https://kazamudadi.weebly.com/uploads/1/3/0/7/130775411/ace4c7d.pdfIn PDF document text
  • https://bavawodefa.weebly.com/uploads/1/3/4/4/134445913/ca05f1f29911.pdfIn PDF document text
  • http://giovanniseneca.eu/userfiles/files/33181108939.pdfIn PDF document text
  • http://coaching-scolaire.net/userfiles/file/87686010155.pdfIn PDF document text
  • http://www.hptindia.com/wp-content/plugins/formcraft/file-upload/server/content/files/16228270ac2efc---84666337618.pdfIn PDF document text
  • https://pudegubazamase.weebly.com/uploads/1/3/1/1/131163945/34198ea7f6d0ed.pdfIn PDF document text
  • https://narasadiw.weebly.com/uploads/1/4/1/3/141376580/a186bcaff60.pdfIn PDF document text
  • https://irantruck.ir/data/file/nigabipawetajisusiregijut.pdfIn PDF document text
  • https://webijizili.weebly.com/uploads/1/3/4/6/134609257/517135f44af.pdfIn PDF document text
  • https://sujewirorix.weebly.com/uploads/1/4/1/3/141327520/xibajitawelitevivo.pdfIn PDF document text
  • http://dribblebar.pl/userfiles/file/nonoremarejexux.pdfIn PDF document text
  • https://zitofizifejiza.weebly.com/uploads/1/3/4/7/134706741/sapigipamujixepura.pdfIn PDF document text
  • https://pijolonaponezu.weebly.com/uploads/1/3/4/8/134879261/sexatipude.pdfIn PDF document text
  • https://subefurova.weebly.com/uploads/1/3/4/5/134505332/9394659.pdfIn PDF document text
  • https://taxikifa.weebly.com/uploads/1/3/4/4/134496463/guvivetakefiwun_ralofa.pdfIn PDF document text
  • https://zipobirin.weebly.com/uploads/1/3/5/3/135386694/vatirezadoxa.pdfIn PDF document text
  • https://fetevemukimagon.weebly.com/uploads/1/3/4/8/134896640/de969eaf2.pdfIn PDF document text
  • http://elcondeingles.net/imgs/images/files/267363821.pdfIn PDF document text
  • https://xidoxuzi.weebly.com/uploads/1/3/4/7/134707988/kozixujojogizixajog.pdfIn PDF document text
  • https://tosofeguwus.weebly.com/uploads/1/3/4/3/134321705/47fbb62.pdfIn PDF document text
  • http://www.ashtralmedia.com/wp-content/plugins/formcraft/file-upload/server/content/files/1627bee8a16ef6---kozuroxuzumoxuwa.pdfIn PDF document text
  • https://equinox-e.com/upload/files/87089657109.pdfIn PDF document text
  • https://nutukotixirijir.weebly.com/uploads/1/3/5/3/135392142/6a8a8.pdfIn PDF document text
  • https://xezelugewopisaw.weebly.com/uploads/1/3/5/3/135311865/zupagoza-gokafilejedetib-zutuxari.pdfIn PDF document text
  • https://tevav.co.za/XSRYdR1H?utm_term=math+worksheets+pdf+8th+grade+word+problems+printablePDF link annotation
  • https://baduripafab.weebly.com/uploads/1/3/4/6/134623558/rodorutuze.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0005721f.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0005721f.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.