Malicious PDF — malware analysis report

Heuristics 8

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Cloud document impersonation lure medium SE_CLOUD_DOC_LURE
  Document impersonates a cloud file-sharing service such as SharePoint, OneDrive, Google Drive, Dropbox, Box, or Microsoft 365 and asks the user to open, verify, or access a shared document
• Urgency / deadline lure low SE_URGENCY_LURE
  Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
• Fake invoice / payment lure low SE_INVOICE_LURE
  Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://crophysi.ru/wix?keyword=corporate+finance+exam+questions+and+answers+pdf In PDF document text

  • https://cdn.sqhk.co/bivuwusim/jgTHfeI/vapivagopezosase.pdfIn PDF document text
  • http://welitizenowem.mywebcommunity.org/62043784889.pdfIn PDF document text
  • http://mukumalatixuji.iblogger.org/allen_bradley_plc_micrologix_1400_manual.pdfIn PDF document text
  • https://cdn.sqhk.co/segenoliz/phihwhc/nifan.pdfIn PDF document text
  • https://cdn.sqhk.co/gevolonovare/tYohfjf/red_vs_blue_characters_ranked.pdfIn PDF document text
  • https://cdn.sqhk.co/towevefizub/hSjaoyG/dark_side_of_the_ring_new_jack_full.pdfIn PDF document text
  • https://cdn.sqhk.co/bovokolel/jDtmjbq/white_light_up_keyboard_wireless.pdfIn PDF document text
  • http://sizuxofutitarax.mypressonline.com/conte_blanche_neige.pdfIn PDF document text
  • https://cdn.sqhk.co/kajurineg/OqThiih/tegojudozarunema.pdfIn PDF document text
  • https://cdn.sqhk.co/nivazesoj/ajdrasU/youtube_video_downloader_for_pc_windows_10.pdfIn PDF document text
  • https://cdn.sqhk.co/wizokawoxo/Gkwhdgg/asgardian_names_female.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • http://refowokewip.rf.gd/avenged_sevenfold_album_nightmare.pdfIn PDF document text
  • http://pijedawometuzov.epizy.com/pisusu.pdfIn PDF document text
  • https://170a7d3c-74f0-42f5-9ead-98ae292a4922.filesusr.com/ugd/a18aa6_183f7420beda4bd8ae3b75f632e52e42.pdf?index=trueIn PDF document text
  • https://e216d865-ddc7-438b-99b2-64609380b1bb.filesusr.com/ugd/7ae8b3_4bcb0d826cb842518b655b1df0dba1a0.pdf?index=trueIn PDF document text
  • http://vunonam.atwebpages.com/bebiwabolusinirufafom.pdfIn PDF document text
  • https://18e99e0c-7034-4a8c-9069-267580a295b8.filesusr.com/ugd/b337f5_7055d8abf74741b387e4588a204be4c7.pdf?index=trueIn PDF document text
  • https://49432a94-54bc-4d13-9d12-ea41d731e1b8.filesusr.com/ugd/a7c689_ce29c3bfe59e414eb0062ab123431467.pdf?index=trueIn PDF document text
  • https://30621b86-6952-4b41-80af-4d24d830bc7c.filesusr.com/ugd/122077_d6b13a9da1ae43eb92be19b1195f02ec.pdf?index=trueIn PDF document text
  • https://48b7024d-7414-4593-b44d-ed892b96ad15.filesusr.com/ugd/3e5db3_5db30672dfd6448ab16d75e36b8ddad8.pdf?index=trueIn PDF document text
  • https://d5fd0048-bb8d-45a1-ba21-28d1cb0b7162.filesusr.com/ugd/5e8de6_400e04667b8e4b7a92f5035ac07de971.pdf?index=trueIn PDF document text
  • https://1923692e-f727-4f58-80a8-3583160180e3.filesusr.com/ugd/c4ccc4_0cbb04410587423db98eaf08168b6da6.pdf?index=trueIn PDF document text
  • https://c480cc3d-c044-45b7-a7fa-747782367dcd.filesusr.com/ugd/a26f59_eef2080b19e6472ab8babbcf9a53f2f2.pdf?index=trueIn PDF document text
  • https://4adff18d-dc39-4349-be2c-eeb12737f1cb.filesusr.com/ugd/9117e0_fe8e090d07fc43638840f15463a7bc07.pdf?index=trueIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.