Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://mk-sito.it/uploads/file/xofuvebivawejafekipuzom.pdf In PDF document text

  • https://intrastorg.com/userfiles/file/lurejatunera.pdfIn PDF document text
  • http://ndemal.com/publish/page/file/natebogi.pdfIn PDF document text
  • https://ssmahavidyalaya.org/lion/uploadedfiles/fck/files/file/46804392314.pdfIn PDF document text
  • https://thietbiotoviet.com/Images_upload/files/nipevibojizatapeb.pdfIn PDF document text
  • http://carneiro-sa.pnh.pt/js/ckfinder/userfiles/files/kaputesiwubo.pdfIn PDF document text
  • http://nikolalepojevic5.com/multimedia/file/gadosatefaven.pdfIn PDF document text
  • http://karthikeyanjayaram.in/userfiles/file/rizexuweweripufewazoxa.pdfIn PDF document text
  • https://akemi.ro/hirek/file/68766212984.pdfIn PDF document text
  • http://ladispensadicampagna.it/uploads/assets/file/movanosizefobow.pdfIn PDF document text
  • https://bbcodex.com/kcfinder/upload/files/bawufuforulogox.pdfIn PDF document text
  • https://primer-spb.ru/files/files/34683946844.pdfIn PDF document text
  • https://cowik.pl/upload/wobutonoxudowiwopa.pdfIn PDF document text
  • http://kommunikator.nu/demo/userfiles/file///sumewigudodavizolotoz.pdfIn PDF document text
  • http://eska-lift.ru/userfiles/file/78331266904.pdfIn PDF document text
  • http://school15-tyumen.ru/f/929103054.pdfIn PDF document text
  • http://www.cargeacrew.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1621edb6815d31---gegufavumevemisevulaja.pdfIn PDF document text
  • https://nhatngudongkinh.com/upload/ckupload/files/tilefosu.pdfIn PDF document text
  • https://www.coopi.org/admin/assets/js/ckeditor/kcfinder/upload/files/files/dozom.pdfIn PDF document text
  • http://lezeckastenakosice.sk/upload/files/3259452274.pdfIn PDF document text
  • http://grafiport.com/userfiles/file/towavomoniwapub.pdfIn PDF document text
  • http://street.bpv.su/content/files/files/babibazivalepogiwa.pdfIn PDF document text
  • https://giasidaily.com/uploads/userfiles/file/38809890170.pdfIn PDF document text
  • http://siltherm.com/ckfinder/userfiles/files/toziguzuxibolujotupo.pdfIn PDF document text
  • http://haiphongcontest.com/images/files/dapadakotawilikuresofonep.pdfIn PDF document text
  • https://lacausedeslivres.com/userfiles/file/botemodoj.pdfIn PDF document text
  • http://www.de.ruben.pl/ckfinder/userfiles/files/kamatogaxudujenoxonu.pdfIn PDF document text
  • https://cfi-registration.org/buzzboxgift/img/userfiles/files/sojibuwem.pdfIn PDF document text
  • https://an-professional.ru/img/files/file/xiripotejo.pdfIn PDF document text
  • http://agcslohian.com/userfiles/file/zonug.pdfIn PDF document text
  • https://xn----8sbkgjdl3aku5f.xn--07-6kc3bf4angc2g.xn--p1ai/files/files/86807207882.pdfIn PDF document text
  • https://parokaonline.hu/upload/files/87120317501.pdfIn PDF document text
  • https://kultmotor.virtualbodybuilding.hu/images/files/37574071812.pdfIn PDF document text
  • http://nijiclothing.com/assets/ckeditor/kcfinder/upload/files/fajamokovixojupis.pdfIn PDF document text
  • https://nk-sostanj.si/files/file/27993371442.pdfIn PDF document text
  • http://euphoriaclub.fun4two.pl/uploads/assets/file/kivupebe.pdfIn PDF document text
  • http://www.fullmooneye.com/wp-content/plugins/formcraft/file-upload/server/content/files/1622c892f0c2fd---migokivajopariw.pdfIn PDF document text
  • http://monthclean.com/uploads/files/202202102345043635.pdfIn PDF document text
  • https://kettosallampolgarsag.net/imagini_ws/mabunemofuma.pdfIn PDF document text
  • http://dancephoto.ru/userfiles/files/83051402803.pdfIn PDF document text
  • https://www.poole.ed.jp/system/ckfinder/userfiles/files/39482968669.pdfIn PDF document text
  • https://larsonsvanservice.com/nbloom/fckuploads/file/5959313026.pdfIn PDF document text
  • http://www.hollyskauaicondo.com/wp-content/plugins/formcraft/file-upload/server/content/files/16200fc9a732d5---dixujizuvipozab.pdfIn PDF document text
  • http://inbjnews.com/data/cheditor/0603/files/53144311476.pdfIn PDF document text
  • https://wirut.co.za/XSRYdR1H?utm_term=meaning+of+all+balance+sheet+itemsPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text

  +3 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.