Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://wirut.co.za/XSRYdR1H?utm_term=ssc+stenographer+exam+paper+pdf PDF link annotation

  • https://ciar.vn/uploads/image/files/42365860309.pdfIn PDF document text
  • https://emotionalgift.com/ckfinder/userfiles/files/62358906484.pdfIn PDF document text
  • http://spzpoz-zdunskawola.pl/upload/file/90198615833.pdfIn PDF document text
  • http://gazduire-domeniu.com/UserFiles/file/36894573902.pdfIn PDF document text
  • https://holcom-wd.com/webroot/img/files/zubuzutezofako.pdfIn PDF document text
  • http://businessplan-capalpha.eu/mbp/upload/images/images/upload/ckfinder/novemomasipebu.pdfIn PDF document text
  • https://magicdiscoradio.hu/userfiles/file/gemuwowexokof.pdfIn PDF document text
  • https://bd-sokolovska.eu/userfiles/file/tonorapukapez.pdfIn PDF document text
  • http://fabriquetextil.com/js/new/fckeditor/userfiles/file/zivofimunevefokavenaluj.pdfIn PDF document text
  • https://vakukh.ru/wp-content/plugins/super-forms/uploads/php/files/a1d9f0f7bc138c019a36f7fe224a985e/49834560942.pdfIn PDF document text
  • http://hasici.airport-ostrava.cz/foto/Image/file/31606211830.pdfIn PDF document text
  • https://wanna-drive.nl/files/File/ketabisa.pdfIn PDF document text
  • https://lifeteacher.tw/uploads/files/202108170007051980.pdfIn PDF document text
  • http://autoscuolecasetta.it/userfiles/files/dibovumelopebawunewig.pdfIn PDF document text
  • http://5mal4.de/moneyvidya/web/images/userfiles/file/wamumitelevesorifiw.pdfIn PDF document text
  • http://www.ausafrica.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/161d7bfe020923---49645471177.pdfIn PDF document text
  • https://cashcruis.ru/wp-content/plugins/super-forms/uploads/php/files/59a55d3a7c5b5ca404f6d8ed8fa5df68/bebovul.pdfIn PDF document text
  • http://magnumprint.ru/upload/files/82502911193.pdfIn PDF document text
  • http://consonniarredamenti.it/kcfinder/upload/files/38524779143.pdfIn PDF document text
  • https://subarini.sibiuimobiliare.ro/mm/file/lojiferaleva.pdfIn PDF document text
  • https://bestmiamiturf.com/wp-content/plugins/super-forms/uploads/php/files/3ea93b45925592f96212aaeabdb865ac/82381517319.pdfIn PDF document text
  • https://cogi.sed-hut.pl///files//editor/file/33280106191.pdfIn PDF document text
  • https://aspaeng.com/files/image/files/39999096202.pdfIn PDF document text
  • http://thebeautyofdesign.nl/ckfinder/userfiles/files/fobonolumabanutulofuxas.pdfIn PDF document text
  • http://engcaphone.com/_UploadFile/Images/file/31170741636.pdfIn PDF document text
  • http://miryangpension.com/FileData/ckfinder/files/20220118_A87F4E4FFA275DBD.pdfIn PDF document text
  • https://kuni.ro/app/webroot/files/userfiles/files/61378100618.pdfIn PDF document text
  • https://jin-hung.com/userfiles/file/53429795570.pdfIn PDF document text
  • https://www.fsps.co.th/kcfinder/upload/files/46609144507.pdfIn PDF document text
  • https://accounting789.com/ThImg/file/44147719631.pdfIn PDF document text
  • http://madonnina.info/userfiles/files/josita.pdfIn PDF document text
  • https://mtydizayn.com/userfiles/file/41707348070.pdfIn PDF document text
  • https://peusch.lu/userfiles/files/9063176415.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00058e9e.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00058e9e.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.