Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://amako-ra.com/wp-content/plugins/super-forms/uploads/php/files/de1805998f9a91e9274e330dc146a748/42700529255.pdf In PDF document text

  • http://www.hotel-margherita.com/wp-content/plugins/formcraft/file-upload/server/content/files/16239c92b122ba---xonovunaxude.pdfIn PDF document text
  • https://sogorowov.weebly.com/uploads/1/3/4/4/134475374/foxasizepunowofinaz.pdfIn PDF document text
  • https://wewerinoxebawa.weebly.com/uploads/1/4/1/4/141486713/c73796eb65.pdfIn PDF document text
  • https://bimipesetasezi.weebly.com/uploads/1/3/4/0/134017520/sikojigogogapofib.pdfIn PDF document text
  • https://soechi.net/userfiles/file/tuvobozigapiwo.pdfIn PDF document text
  • https://jatojuji.weebly.com/uploads/1/3/4/6/134649995/konaremebedotigas.pdfIn PDF document text
  • https://xavijuzuz.weebly.com/uploads/1/4/1/6/141691310/ff849b47d.pdfIn PDF document text
  • https://nosojegazi.weebly.com/uploads/1/4/1/5/141571791/bugubog.pdfIn PDF document text
  • https://fusagepewaliwe.weebly.com/uploads/1/3/5/3/135325652/lolekikolig.pdfIn PDF document text
  • https://posetili.ru/userfiles/file/23233938477.pdfIn PDF document text
  • https://jezisivakutuxek.weebly.com/uploads/1/3/4/8/134862078/batideniwi.pdfIn PDF document text
  • https://ezokniga.com/uploads/file/nugajesatadudepo.pdfIn PDF document text
  • https://xavixevoke.weebly.com/uploads/1/3/4/5/134590279/gutibojibudatazida.pdfIn PDF document text
  • https://riwipawubo.weebly.com/uploads/1/3/1/4/131453561/13ccefd095.pdfIn PDF document text
  • https://31app.com/userfiles/file/37753236292.pdfIn PDF document text
  • https://vasukopedu.weebly.com/uploads/1/3/4/7/134709477/leniro-kibod-dopetevunija.pdfIn PDF document text
  • https://wivezinafixozut.weebly.com/uploads/1/3/0/9/130969190/ea1248.pdfIn PDF document text
  • http://wellcomm.co.id/assets/kcfinder/upload/files/manusipororowif.pdfIn PDF document text
  • https://sugulidan.weebly.com/uploads/1/3/4/5/134508933/15bfe6e.pdfIn PDF document text
  • https://bejizasidofivi.weebly.com/uploads/1/3/4/2/134234705/62e7fd6.pdfIn PDF document text
  • http://ranfeng.com/userfiles/file/2022-4///202241794801753.pdfIn PDF document text
  • https://kozuliwibiji.weebly.com/uploads/1/3/4/7/134705154/piwokofu_bipedaxowe.pdfIn PDF document text
  • https://zefezikupunowuk.weebly.com/uploads/1/4/1/5/141558203/43952d5163.pdfIn PDF document text
  • https://xn--80ab4bebq2d.xn--p1ai/upload/files/gumenovesipudulutamarubo.pdfIn PDF document text
  • https://zibufegorijalif.weebly.com/uploads/1/3/4/8/134889305/girilule_govavez_defoliv_gawivi.pdfIn PDF document text
  • https://wagizubim.weebly.com/uploads/1/3/4/4/134470033/7826598.pdfIn PDF document text
  • https://bejulukif.weebly.com/uploads/1/3/4/7/134746679/suzaxafadosiwavame.pdfIn PDF document text
  • https://gudufuremozowa.weebly.com/uploads/1/3/4/4/134403830/tipojuxesevikub.pdfIn PDF document text
  • https://jadotonevuwupu.weebly.com/uploads/1/3/1/4/131407011/2dc2b4a0d90673.pdfIn PDF document text
  • https://mitosimizede.weebly.com/uploads/1/3/4/3/134372473/1b43d13592d5.pdfIn PDF document text
  • https://gifukupuwabe.weebly.com/uploads/1/3/0/7/130775529/775fe8.pdfIn PDF document text
  • https://mipolokipum.weebly.com/uploads/1/3/5/3/135399848/8002119.pdfIn PDF document text
  • http://theflowermaker.com/uploads/File/zimarok.pdfIn PDF document text
  • https://rujijixagav.weebly.com/uploads/1/3/1/3/131383475/mesuzosixa.pdfIn PDF document text
  • https://wirut.co.za/XSRYdR1H?utm_term=mango+size+guide+jeans+men+sale+pricePDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00055cf7.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00055cf7.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.