Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://fecuq.co.za/XSRYdR1H?utm_term=brand+banjo+new+song PDF link annotation

  • https://pelletier-tp.fr/ckfinder/userfiles/files/repojom.pdfIn PDF document text
  • https://pokumajapemen.weebly.com/uploads/1/3/4/4/134490217/1213713.pdfIn PDF document text
  • https://activepymes.com/pub/file/42441149488.pdfIn PDF document text
  • http://files.ibiza-ferien.de/file/50283303695.pdfIn PDF document text
  • https://vesokawewewavi.weebly.com/uploads/1/3/1/3/131382886/xezibananifav_favegivijupup_legalojapani_dudoseris.pdfIn PDF document text
  • http://yogaschoolofkerala.com/photos/editor/files/33685916310.pdfIn PDF document text
  • http://tvkinter.com/file_media/file_image/file/77345895941.pdfIn PDF document text
  • https://rurubimak.weebly.com/uploads/1/3/4/5/134594751/1009117.pdfIn PDF document text
  • http://www.forsheda.se/admin/kcfinder/upload/files/91084283976.pdfIn PDF document text
  • https://wijukipofijiko.weebly.com/uploads/1/3/4/3/134381856/5365701.pdfIn PDF document text
  • https://sejuxotanodefif.weebly.com/uploads/1/3/5/9/135957191/5619061.pdfIn PDF document text
  • https://situzofunuk.weebly.com/uploads/1/3/5/3/135305293/xasopoj_lakobajexavewiz_zopera.pdfIn PDF document text
  • https://bujivopipagafo.weebly.com/uploads/1/3/5/3/135321681/b96e7accd4d.pdfIn PDF document text
  • https://wafewukim.weebly.com/uploads/1/3/5/3/135399971/xivigakiwituraguw.pdfIn PDF document text
  • https://sejujilebenifej.weebly.com/uploads/1/3/4/8/134886687/bogewuj_nopoxasokago.pdfIn PDF document text
  • https://duwifugikez.weebly.com/uploads/1/3/5/3/135351140/4908023.pdfIn PDF document text
  • https://thaodienland.com/fckeditor/editor/filemanager/connectors/php/temp/file/vimisunitapunemosuze.pdfIn PDF document text
  • https://tafipesep.weebly.com/uploads/1/4/1/6/141635748/c1dac39f31a.pdfIn PDF document text
  • https://shinaltd.ru/images/file/jovoliwuxezoxigi.pdfIn PDF document text
  • http://sromedical.com/file_media/file_image/file/69000005587.pdfIn PDF document text
  • https://kizinuraximi.weebly.com/uploads/1/3/4/4/134446503/b1ef7168b46e605.pdfIn PDF document text
  • https://fonixokud.weebly.com/uploads/1/3/5/4/135400654/kujejuxo.pdfIn PDF document text
  • https://bulobazopikiju.weebly.com/uploads/1/3/0/7/130776241/43a7f84fafa23.pdfIn PDF document text
  • https://sixapinipuso.weebly.com/uploads/1/3/1/3/131384402/laxatudop-wodolimoviwute-zukokobo-tubatapopop.pdfIn PDF document text
  • http://moutierrozeille.fr/userfiles/file/43036343989.pdfIn PDF document text
  • https://ludutaxe.weebly.com/uploads/1/3/0/8/130814402/8409677.pdfIn PDF document text
  • http://csc-tp.com/userfiles/file/20220224094520_yw1tvb.pdfIn PDF document text
  • https://sufidubiziden.weebly.com/uploads/1/3/4/7/134732268/voledanijokafig-vafovadakixaze.pdfIn PDF document text
  • https://gimepaponu.weebly.com/uploads/1/3/4/6/134614910/jujubalawemiro.pdfIn PDF document text
  • https://rokozozo.weebly.com/uploads/1/3/4/4/134498035/xuwelilexel.pdfIn PDF document text
  • https://ritefebeg.weebly.com/uploads/1/3/5/3/135316582/96cafc56.pdfIn PDF document text
  • https://meverelalopabij.weebly.com/uploads/1/3/4/1/134108836/f8edbb3c3.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0003e183.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0003e183.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.