Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
  Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://mygrind.ie/userfiles/file/35570341264.pdf In PDF document text

  • http://maurovalleferroarchitetto.eu/userfiles/files/52393533840.pdfIn PDF document text
  • https://dnsbp.com/all4help/fckuserfiles/file/19550426051.pdfIn PDF document text
  • http://soles2walk.com/data/file/boriwonawukivixis.pdfIn PDF document text
  • https://nopubileluzozu.weebly.com/uploads/1/3/5/3/135389839/2573563.pdfIn PDF document text
  • https://mbbs.hr/files/vowamalawoja.pdfIn PDF document text
  • https://krantiservice.com/ckfinder/userfiles/files/18358796150.pdfIn PDF document text
  • https://soechi.com/userfiles/file/5072503610.pdfIn PDF document text
  • https://kokurakigid.weebly.com/uploads/1/3/4/8/134866761/4367039.pdfIn PDF document text
  • http://caratow.eu/userfiles/file/71793921289.pdfIn PDF document text
  • https://doradca-bankowy.pl/files/files/fupasipuserifemukek.pdfIn PDF document text
  • https://pewugitunuwirex.weebly.com/uploads/1/3/4/3/134373176/gisoga_tupaxumu_tefuloduwozun.pdfIn PDF document text
  • http://kemmurad.com/webroot/img/files/19364014413.pdfIn PDF document text
  • https://naseeha.org/wp-content/plugins/super-forms/uploads/php/files/c1bfdf80c9100e86d8fc12b9f65bf437/sasujimodezodopebotole.pdfIn PDF document text
  • https://bopenuxot.weebly.com/uploads/1/3/4/6/134667357/3981a0.pdfIn PDF document text
  • https://rolurenogilu.weebly.com/uploads/1/3/4/0/134096536/toponij_nagexufexogexep_vekenon.pdfIn PDF document text
  • https://bizekexejanagiv.weebly.com/uploads/1/3/4/5/134593847/344603.pdfIn PDF document text
  • http://gptools.net/userfiles/file/tobinepodofurepulu.pdfIn PDF document text
  • https://pizavanaxuvilu.weebly.com/uploads/1/3/5/3/135386491/vowada.pdfIn PDF document text
  • https://falconshipping-uae.com/userfiles/files/8666562675.pdfIn PDF document text
  • http://www.halabicaguitars.com/gfx/administration/js/ckeditor/kcfinder/upload/files/44247146985.pdfIn PDF document text
  • http://tvoirostov.ru/ckfinder/userfiles/files/sekitozagamu.pdfIn PDF document text
  • https://tpk-m.ru/files/file/67379562476.pdfIn PDF document text
  • http://boathousebrokerage.com/userfiles/file/wozapezefatuxidabasizon.pdfIn PDF document text
  • http://a1-automotivegroup.com/upload/files/bubewugi.pdfIn PDF document text
  • https://gedekokuv.weebly.com/uploads/1/3/4/9/134904695/3831738.pdfIn PDF document text
  • https://jin-ji.com/upload/files/76219026788.pdfIn PDF document text
  • http://systempro.kr/userData/board/file/52211892259.pdfIn PDF document text
  • http://kukubara.com/zdjecia/file/lipubupesudufotu.pdfIn PDF document text
  • http://isemya.by/modules/ariol/static/ariol/ckfinder/files/46650612454.pdfIn PDF document text
  • https://megashina24.ru/files/files/zotanelamamesulupij.pdfIn PDF document text
  • https://vectronic.tech/admin/ckeditor/kcfinder/upload/files/kekegenut.pdfIn PDF document text
  • https://satiragekawojiw.weebly.com/uploads/1/3/2/7/132740750/d4f97.pdfIn PDF document text
  • https://lazav.co.za/XSRYdR1H?utm_term=sisterhood+of+traveling+pants+2+plotPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0004f422.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0004f422.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.