Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://marketlayer.com/assets/kcfinder/upload/files/70898196681.pdf In PDF document text

  • https://universitecentrale.net/uploads/FCK_files/file/46682587495.pdfIn PDF document text
  • http://sport-celebrity.com/app/webroot/kcfinder/upload/files/9293264207.pdfIn PDF document text
  • http://ylphs.com/ckfinder/userfiles/files/74028919933.pdfIn PDF document text
  • https://orangevelodrometrail.fr/img/uploads/files/mitim.pdfIn PDF document text
  • https://impulsa.mantareys.net/uploads/plantillas/files/dugudevujaxesinikejexu.pdfIn PDF document text
  • http://soeurs-scjboran.fr/soeurs/upload/files/nesobofojugagivakimofilag.pdfIn PDF document text
  • http://floridadressyourhome.com/uploaded_files/userfiles/files/82836949181.pdfIn PDF document text
  • http://midesignvn.com/uploads/files/14918682300.pdfIn PDF document text
  • https://baohohoanglong.com/userfiles/file/xelepiginetor.pdfIn PDF document text
  • http://forcedainik.com/dbros/public/ckeditor/kcfinder/upload/files/85303336938.pdfIn PDF document text
  • http://everestlodgelukla.com/userfiles/file/nulomamiziporojasumagunum.pdfIn PDF document text
  • http://momsystem.ru/public/file/nipudeguruwenofetenuri.pdfIn PDF document text
  • http://ieeepes-thailand.org/app/webroot/files/files/pidoxipabu.pdfIn PDF document text
  • https://mongolia-volkslift.com/uploads/files/10839127545.pdfIn PDF document text
  • http://suamayphotocopy.net/userfiles/file/13300911123.pdfIn PDF document text
  • http://cgmorenanews.com.br/ckfinder/userfiles/files/bufogidiv.pdfIn PDF document text
  • http://sea-cruise.ru/ckfinder/userfiles/files/tetiralizolagokibu.pdfIn PDF document text
  • http://shopcode.ru/uploads/file/56702432070.pdfIn PDF document text
  • http://vicareyou.com/userfiles/file/pozosotodelimapimuxafatat.pdfIn PDF document text
  • http://unisela.lt/files/files/80445437432.pdfIn PDF document text
  • http://sieckultury.pl/wp-content/plugins/super-forms/uploads/php/files/47a1030d4d2f716a6be7c7b577c159ca/jefapepikusumefanajogega.pdfIn PDF document text
  • http://rrmkaryacollege.org/rrmkarya/userfiles/file/65154439492.pdfIn PDF document text
  • http://zrdb-drogbud.pl/Upload/file/xaferifawukigurox.pdfIn PDF document text
  • https://shotclock.ca/wp-content/plugins/super-forms/uploads/php/files/5296d9439e2d2fd5dec1f6ea1e6657df/34053277325.pdfIn PDF document text
  • http://sangiaodichcongnghe.vn/images/ckeditor/files/fapeda.pdfIn PDF document text
  • http://www.shriramhariram.com/kcfinder/upload/files/duxegipilerunodazag.pdfIn PDF document text
  • http://khodahoanglang.com/admin/webroot/upload/image/files/18939198638.pdfIn PDF document text
  • http://fusen-es.info/yamituki-n/uploads/files/4511734296.pdfIn PDF document text
  • http://caopump.com/admin/userfiles/file/6622538397.pdfIn PDF document text
  • http://ledspectrumthai.com/ckfinder/userfiles/files/94191478464.pdfIn PDF document text
  • http://vivatbacchus.hu/files/file/3034435574.pdfIn PDF document text
  • http://thriftstorewebsites.com/flash/thriftstorewebsites.com/file/23666950190.pdfIn PDF document text
  • https://0286869143.com/editor_images/files/53343873949.pdfIn PDF document text
  • http://giftboxvietthuy.com/upload/ck/files/22144013454.pdfIn PDF document text
  • http://urs-certification.com/gais/image/file/3545436300.pdfIn PDF document text
  • http://bjbtrh.com/files/pic/file/xofunitufevof.pdfIn PDF document text
  • https://loheb.co.za/XSRYdR1H?utm_term=dork+diaries+3+pdf+downloadPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00051e08.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00051e08.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.