Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• PDF advertises pirated movie streaming/download medium PDF_PIRACY_STREAMING_LURE
  PDF rendered text advertises free full-movie streaming or download using piracy-brand names or a 'full movie + download/free/watch' intent phrase — recovered after folding the styled Unicode confusables the campaign uses to hide those keywords from plain-text detection. These are disposable SEO-spam carriers that route users to malvertising, fake-player, and scam pages; the PDF itself is inert.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://nisseiplastic.com/up_images/exp/files/tijagugil.pdf In PDF document text

  • http://blfimmobiliare.com/userfiles/files/63923820948.pdfIn PDF document text
  • http://deryalvincotokurtarma.com/userfiles/file/baxomivodokipixor.pdfIn PDF document text
  • http://csc-0411.com/userfiles/file/20220313060526_ly088l.pdfIn PDF document text
  • https://liad-alger.fr/admin/style/js/edit/kcfinder/..%5Cimages%5Ccontenue/files/rizupe.pdfIn PDF document text
  • http://westfield.qa/multimedia/userfiles/file/rojapos.pdfIn PDF document text
  • https://auto-rujo.com/images-editor/file/nufituxuzotixekemi.pdfIn PDF document text
  • http://seeweb.ciscoxmlservices.com/img/temp/file/97414614759.pdfIn PDF document text
  • http://5mal4.de/moneyvidya/web/images/userfiles/file/nusonevarikirisoletuniw.pdfIn PDF document text
  • http://cuacuonductudong.com/upload/files/16406031042.pdfIn PDF document text
  • http://captainkillmite.com/uploads/files/202203080854168538.pdfIn PDF document text
  • http://tdybio.com/uploadfile/file///2022030322453598.pdfIn PDF document text
  • http://7foro.exceltur.org/exceltur_nuevo/ckfinder/userfiles/files/wufudixisusap.pdfIn PDF document text
  • https://myparrotfood.com/user_files/files/tigalanegitefitud.pdfIn PDF document text
  • http://www.imcet.org.tr/kcfinder/upload/files/11615207865.pdfIn PDF document text
  • http://glovimex.com/uploads/ckfinder/files/59992652196.pdfIn PDF document text
  • http://hammaddedunyasi.com/panel/kcfinder/upload/files/69995462352.pdfIn PDF document text
  • http://botan-koubou.com/js/kcfinder/upload/files/dapavumemanetakuj.pdfIn PDF document text
  • http://managhantasala.net/mailuserfiles/file/98125229711.pdfIn PDF document text
  • https://www.carlosfunes.es/wp-content/plugins/formcraft/file-upload/server/content/files/16219716e6001c---51417883771.pdfIn PDF document text
  • http://helenhotel.vn/upload/files/fujokemopopexupomoxadaj.pdfIn PDF document text
  • http://architectureanddesign.it/userfiles/files/sutububirosos.pdfIn PDF document text
  • http://4chan.ro/UserFiles/file/zawibejifoluberepar.pdfIn PDF document text
  • http://carszana.com/image/upload/File/dapovemoro.pdfIn PDF document text
  • http://www.1atlanticfunding.com/wp-content/plugins/formcraft/file-upload/server/content/files/1622112878b437---51651326886.pdfIn PDF document text
  • http://radio-salsa.fr/php/rs/filesupload/file/sawed.pdfIn PDF document text
  • http://conflictfreeelectronics.com/ourprojects/chowki/UserFiles/renuka/file/gudulapa.pdfIn PDF document text
  • http://www.bongbansaigon.com/uploads/files/14852676097.pdfIn PDF document text
  • https://gyogytorna-vac.hu/admin/kcfinder/upload/files/rakigovedaw.pdfIn PDF document text
  • https://fda.weblineinfosoft.com/UserFiles/files/zikewomopisevitezoxixegu.pdfIn PDF document text
  • http://p-itos.net/admin/userfile/image/file/80085420861.pdfIn PDF document text
  • https://retentionstudentexperience.com/wp-content/plugins/formcraft/file-upload/server/content/files/16219c09531c3a---dafubimubowimuvejumaxazi.pdfIn PDF document text
  • https://howardtatelaw.com/UserFiles/File/21342370944.pdfIn PDF document text
  • https://namhunglogistic.vn/site/files/zeputulelanaxeku.pdfIn PDF document text
  • https://www.camaragranada.org/administracion/kcfinder/upload/files/wosusolovesumabikivaxo.pdfIn PDF document text
  • http://slowjamsundays.com/wp-content/plugins/formcraft/file-upload/server/content/files/16227d08be0a52---40975212447.pdfIn PDF document text
  • https://berker-rozetki.su/kcfinder/upload/files/rodikududusana.pdfIn PDF document text
  • http://iabmbikaner.org/public/ckeditor/kcfinder/upload/files/fexedowanetidanele.pdfIn PDF document text
  • http://alphanaturehk.com/userfiles/file/jasal.pdfIn PDF document text
  • http://enjoyisagenix.com/ckfinder/userfiles/files/59863445957.pdfIn PDF document text
  • https://christavedelaar.nl/bestanden/files/385286604.pdfIn PDF document text
  • https://www.zwaanshoek.info/gibreto-cms/xcrud/editors/kcfinder/upload/files/19460855147.pdfIn PDF document text
  • https://colod.co.za/XSRYdR1H?utm_term=attarintiki+daredi+film+songsPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000453da.bin)

  +1 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.