Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://sunuf.co.za/XSRYdR1H?utm_term=delayed+dark+brotherhood+attack+v2 PDF link annotation

  • http://leinerpakgelatine.com/survey/userfiles/files/54096588945.pdfIn PDF document text
  • https://chineseclothingonline.com/File/gokukagojizidimebub.pdfIn PDF document text
  • https://xorozatu.weebly.com/uploads/1/3/4/4/134461248/4233116.pdfIn PDF document text
  • https://wigomikutoji.weebly.com/uploads/1/4/1/2/141252003/sawuxa.pdfIn PDF document text
  • https://xasejudezorakoz.weebly.com/uploads/1/3/0/8/130813307/xeditan.pdfIn PDF document text
  • https://wezalowesugalu.weebly.com/uploads/1/3/2/8/132815960/mizesevoraxiger.pdfIn PDF document text
  • http://www.hollyskauaicondo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1620366095741c---sepanotarejozoli.pdfIn PDF document text
  • https://kozulewikije.weebly.com/uploads/1/3/4/6/134682997/b3fec191a.pdfIn PDF document text
  • https://lanufuxag.weebly.com/uploads/1/3/0/9/130969896/fubejuxopubir-denevotudaduf-rurazukoleru-nixidis.pdfIn PDF document text
  • https://zubagobo.weebly.com/uploads/1/4/1/3/141300624/9426472.pdfIn PDF document text
  • https://zedusolurifi.weebly.com/uploads/1/3/3/9/133999882/1a5f815a57fd.pdfIn PDF document text
  • https://zosumomaxin.weebly.com/uploads/1/3/4/0/134040430/c22ac29fd05a.pdfIn PDF document text
  • http://przystaneknida.pl/data/aktualnosci_imgs/file/babefefemepozajosataful.pdfIn PDF document text
  • https://mevemedetu.weebly.com/uploads/1/3/1/8/131871578/tobonesitinal_jawajore_xenozokimixe.pdfIn PDF document text
  • http://nattukoottam.com/userfiles/file/86368788516.pdfIn PDF document text
  • https://vunulenib.weebly.com/uploads/1/3/2/3/132303041/mipabarere.pdfIn PDF document text
  • https://demenuxukuxit.weebly.com/uploads/1/3/1/4/131438289/rawemej.pdfIn PDF document text
  • https://xikigojajutu.weebly.com/uploads/1/3/4/3/134385057/zegejixikup.pdfIn PDF document text
  • https://linuvovozesuv.weebly.com/uploads/1/3/4/7/134774252/kiwugedo.pdfIn PDF document text
  • https://dipojujepu.weebly.com/uploads/1/3/4/5/134526160/norodijuwemapeno.pdfIn PDF document text
  • https://puvomowaja.weebly.com/uploads/1/3/4/3/134318832/5127595.pdfIn PDF document text
  • https://vujanakisa.weebly.com/uploads/1/3/4/4/134401771/kugejozodorar.pdfIn PDF document text
  • https://nuvaxavixo.weebly.com/uploads/1/3/0/7/130738964/4579206.pdfIn PDF document text
  • http://www.leasebridge.com/CKUPimg/files/4806119017.pdfIn PDF document text
  • https://mulidugegobivim.weebly.com/uploads/1/3/4/3/134318636/vogifamor-wetusibuwogof.pdfIn PDF document text
  • https://wagofokixe.weebly.com/uploads/1/3/4/6/134694124/0cf201ed.pdfIn PDF document text
  • http://vet-spb.com/userfiles/file/kowaxofis.pdfIn PDF document text
  • https://wewototubuwasef.weebly.com/uploads/1/3/4/6/134631688/rokogufalafufed.pdfIn PDF document text
  • https://dejatenuti.weebly.com/uploads/1/3/5/3/135348415/7621274.pdfIn PDF document text
  • https://zitakusosexozi.weebly.com/uploads/1/3/4/5/134595565/salanukunulasi.pdfIn PDF document text
  • https://tizukusijevawus.weebly.com/uploads/1/3/4/4/134454617/zuladikoguxatelebi.pdfIn PDF document text
  • https://megidawuxuta.weebly.com/uploads/1/3/4/7/134729580/16d2c27.pdfIn PDF document text
  • https://sivenusa.weebly.com/uploads/1/3/1/1/131164431/fizufopirawe.pdfIn PDF document text
  • https://xoforovujedopod.weebly.com/uploads/1/3/4/5/134587448/vireruwokowojeg.pdfIn PDF document text
  • https://xagapetudiza.weebly.com/uploads/1/3/4/6/134686513/dekiz.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0004f911.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0004f911.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.