Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://wirut.co.za/XSRYdR1H?utm_term=doctor+faustus+side+by+side+translation PDF link annotation

  • https://akgoz.zemta.com/uploads/files/gizopeximubadinubulegu.pdfIn PDF document text
  • http://t-cso.com/upload/file_folder/file/58415083359.pdfIn PDF document text
  • https://milenja.com/assets/kcfinder/upload/files/84197337815.pdfIn PDF document text
  • http://bagiez.com/userfiles/file/56952143783.pdfIn PDF document text
  • https://matharu.ae/userfiles/file/zikunisokabokavap.pdfIn PDF document text
  • https://chambredhotes-savoie.com/ckfinder/userfiles/files/38507256440.pdfIn PDF document text
  • https://felixtrail.com/imagini_ws/dazopukuxutozivit.pdfIn PDF document text
  • https://melenoradu.weebly.com/uploads/1/3/4/3/134340649/rowepuzase-lutopos.pdfIn PDF document text
  • https://hkdotbuy.com/editor_upload_image/file/xexulokofemisemugod.pdfIn PDF document text
  • http://xn--or3bo5mvlb.com/data/editor/file/89022024963.pdfIn PDF document text
  • http://rivebistro.net/ckfinder/userfiles/files/buwavodewaxit.pdfIn PDF document text
  • http://studioingegneriavaragnolo.com/userfiles/files/biwuk.pdfIn PDF document text
  • https://www.medicalart.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/161f8620f2de69---67059228909.pdfIn PDF document text
  • http://promerilaclama.com.tr/panel/kcfinder/upload/files/jusizaritakesopoxigime.pdfIn PDF document text
  • https://selepofobalolu.weebly.com/uploads/1/3/1/8/131856949/zobulafifarol_xodixosixev_wizewemupu_nozuzumolo.pdfIn PDF document text
  • https://ladulokepalixu.weebly.com/uploads/1/3/4/8/134878898/22882d0.pdfIn PDF document text
  • http://sola-brothers.com/userfiles/file/23989577952.pdfIn PDF document text
  • https://coachtourbusrental.com/wp-content/plugins/formcraft/file-upload/server/content/files/1622360a12fd0b---papanufaz.pdfIn PDF document text
  • https://nepubodi.weebly.com/uploads/1/3/4/6/134610278/bibawurujifokewubafa.pdfIn PDF document text
  • https://mamadona.ru/ckfinder/userfiles/files/fekinamubinikigujozebuful.pdfIn PDF document text
  • https://vexusonefopi.weebly.com/uploads/1/3/4/5/134583249/7893153.pdfIn PDF document text
  • https://wudopivuvev.weebly.com/uploads/1/3/4/7/134752163/soxejowe_sakuvazaxuv_darisi.pdfIn PDF document text
  • https://kufurana.weebly.com/uploads/1/3/1/4/131482954/dizovifusevawikud.pdfIn PDF document text
  • http://tehla.eu/userfiles/file/33403675428.pdfIn PDF document text
  • http://kytero.com/admin/kcfinder/upload/files/27654994013.pdfIn PDF document text
  • https://jodhpurtravels.com/nbloom/fckuploads/file/37935291443.pdfIn PDF document text
  • http://yesilyurtalm.com/userfiles/file/75750939793.pdfIn PDF document text
  • https://www.oabrn.org.br/2017/_ups/files/files/visedifazegosijilubixat.pdfIn PDF document text
  • https://tapexibe.weebly.com/uploads/1/4/1/2/141257831/3201461.pdfIn PDF document text
  • https://whitelightdesign.com/wp-content/plugins/super-forms/uploads/php/files/86c74c229cb30a2b35d0270e0e81c03e/vesomunilolodo.pdfIn PDF document text
  • https://wopewajut.weebly.com/uploads/1/3/4/6/134664352/7aa029.pdfIn PDF document text
  • https://sobaxijuxoje.weebly.com/uploads/1/3/4/2/134235367/695815a31.pdfIn PDF document text
  • http://cripper.de/media/semevebiji.pdfIn PDF document text
  • http://satthachkhe.vn/image/file/51574109712.pdfIn PDF document text
  • https://fundreamz.com/ckfinder/userfiles/files/69161614884.pdfIn PDF document text
  • https://siweporabid.weebly.com/uploads/1/3/5/3/135345409/947a8.pdfIn PDF document text
  • https://wapixetisabin.weebly.com/uploads/1/3/4/6/134685373/duwem.pdfIn PDF document text
  • https://vidulegu.weebly.com/uploads/1/3/4/8/134897898/gazilel_mebebowunubes_rimati.pdfIn PDF document text
  • http://bestbelly.org/content/files/files/96579448111.pdfIn PDF document text
  • http://lgassociates.in/uploads/43975196982.pdfIn PDF document text
  • http://neowork-rh.com/userfiles/file/40983973317.pdfIn PDF document text
  • http://dbexpertise.fr/catalogue_dynamique/file/gonuwotewugexiti.pdfIn PDF document text
  • https://dedorewesapizeb.weebly.com/uploads/1/3/4/2/134265869/709d84a93ecc.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text

  +2 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.