Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Embedded JS stream low PDF_JS
  PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://fecuq.co.za/XSRYdR1H?utm_term=harry+potter+half+blood+prince+download PDF link annotation

  • https://keguvetazako.weebly.com/uploads/1/3/4/7/134702613/e01fc0.pdfIn PDF document text
  • http://www.alex-vasilkov.ru/images/wisdom/file/4413026760.pdfIn PDF document text
  • http://nadiadsa.org/userfiles/file/26083124316.pdfIn PDF document text
  • http://nepaldristi.com/dbros/public/ckeditor/kcfinder/upload/files/funedajogojororez.pdfIn PDF document text
  • http://smcertificationservices.com/userfiles/files/9491537784.pdfIn PDF document text
  • http://sperrincaravans.com/images/file/93019291530.pdfIn PDF document text
  • http://kirks-pool.com/wp-content/plugins/formcraft/file-upload/server/content/files/16229a8799ecca---16012322868.pdfIn PDF document text
  • http://y-mirai.biz/js/kcfinder/upload/files/55327020056.pdfIn PDF document text
  • https://bizugejukuvav.weebly.com/uploads/1/3/4/3/134322279/3218176.pdfIn PDF document text
  • https://zepafasamog.weebly.com/uploads/1/3/4/3/134361306/6112067.pdfIn PDF document text
  • https://xijitivagafe.weebly.com/uploads/1/3/4/7/134709267/tamapotu.pdfIn PDF document text
  • https://krygina40.ru/UserFiles/File/21136200696.pdfIn PDF document text
  • http://hnfond.cz/storage/file/45341282599.pdfIn PDF document text
  • http://4reality.cz/userfiles/files/kujalimev.pdfIn PDF document text
  • http://www.oftalmed.com.br/files/ckeditor_custom/kcfinder/upload/files/91461030297.pdfIn PDF document text
  • https://batibama.weebly.com/uploads/1/3/4/3/134338422/basisix-tudoxapowimoxu-dibenavozadadeb.pdfIn PDF document text
  • https://teregurejojexol.weebly.com/uploads/1/3/4/8/134879353/6577332.pdfIn PDF document text
  • http://gulfcoastlist.com/userfiles/file/1545422069.pdfIn PDF document text
  • https://sumijiluwovoj.weebly.com/uploads/1/3/4/2/134266387/1885639.pdfIn PDF document text
  • https://rwd.webseo.tw/upload/files/guwupabopogogakizilupida.pdfIn PDF document text
  • http://greeninfrabd.com/assets/ckeditor/kcfinder/upload/files/47450423787.pdfIn PDF document text
  • https://validujagobun.weebly.com/uploads/1/3/4/5/134526773/xururavelugopoxeduf.pdfIn PDF document text
  • https://hideab.se/tc/Mediagalleri/file/42293404559.pdfIn PDF document text
  • https://zozolunefa.weebly.com/uploads/1/3/5/3/135325744/wowowexi.pdfIn PDF document text
  • https://wisapapeb.weebly.com/uploads/1/3/4/5/134594170/juxajanuxosiz.pdfIn PDF document text
  • https://bijazebis.weebly.com/uploads/1/3/1/3/131382141/kubavat_wodofugu.pdfIn PDF document text
  • https://xn--80aesyq.xn--p1ai/files/file/44146071975.pdfIn PDF document text
  • https://photographerin.agency/wp-content/plugins/super-forms/uploads/php/files/qd20jfmeq2b92ln3neherd8c16/jumipoxem.pdfIn PDF document text
  • http://hockjoohin.com/admin/uploads/file/65016748696.pdfIn PDF document text
  • http://www.timtransportes.com/home/wp-content/plugins/formcraft/file-upload/server/content/files/16243a1941a7ab---zejopafe.pdfIn PDF document text
  • https://chandigarhdatarecovery.com/files/file/wewuvodimujama.pdfIn PDF document text
  • http://foto-recepty.sk/images/fotky/51642859172.pdfIn PDF document text
  • http://www.neslihanonur.com/wp-content/plugins/super-forms/uploads/php/files/29fe2d1b476992695853af5b52f386d7/92337901211.pdfIn PDF document text
  • http://77owship.netsociality.com/upload/files/mipomixasagisi.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.