Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
  Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://irlanc.ru/square?utm_term=core+java+interview+questions+and+answers+pdf+download PDF link annotation

  • https://www.truemark.dev/DevelopersIn PDF document text
  • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f79562ab09506512d59811/1626838371030/bazataw.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e90c03b630645a0ef692b4/1625885699671/the_alchemist_test_answers.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e8cf008b9e53115d66ac9e/1625870080237/kafunajakozebe.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ee4f67bb85ab7f02be18ce/1626230631408/how_to_make_a_smaller_file_size.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f6ee0793ff503a8837b1d4/1626795527183/23918371771.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f02ac01a40e7189053fd99/1626352320514/2_heads_are_better_than_none.pdfIn PDF document text
  • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ec92737d354a5e86a4289b/1626116723275/40508418366.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f671ed1a3fa17743d36769/1626763757569/marginal_income_statement_format.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f5ee4b20a16b089450ddb3/1626730059902/how_many_play_cards.pdfIn PDF document text
  • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60f019f6d77757041654d2a6/1626348022281/58455244682.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f17b15da20a917db534e79/1626438421415/courage_of_convictions.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f7bcde67b36875348ac968/1626848478950/feather_star_class.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f14841adf71e7547ce4a5f/1626425409631/importance_of_meiosis_in_humans.pdfIn PDF document text
  • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e87890afb4337c4834f934/1625847952511/7473097266.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f759247e7f987cdf1ad650/1626822948137/telegraphic_stage_of_language_acquisition.pdfIn PDF document text
  • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f431feaba5f52989b0f7e2/1626616318859/83690939932.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ed9b5ff827c554fd9f9c8b/1626184543657/psiphon_cracked_for_windows.pdfIn PDF document text
  • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60eca7e83080d76c7a5455ff/1626122216221/water_supply_and_sanitary_engineering_by_rangwala.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f15e42c825a553dff73c44/1626431042663/mcq_in_research_methodology_with_answers.pdfIn PDF document text
  • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60f064687c351464f955a3f7/1626367080458/definition_of_technology_integration.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60eca16f3631fd4ab8191004/1626120559097/gizen.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.