Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
  Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://weddingfavoursfor.co.uk/kcfinder/upload/files/1820542207.pdf In PDF document text

  • https://pejomanizo.weebly.com/uploads/1/4/1/4/141496561/zexomaru_xipawulazokuvil_xinanurof.pdfIn PDF document text
  • http://retete.pentrugatit.ro/userfiles/file/41898609405.pdfIn PDF document text
  • https://gipimosikiji.weebly.com/uploads/1/3/5/9/135963651/mimun.pdfIn PDF document text
  • http://special-pharma.com/upload/files/gopexixi.pdfIn PDF document text
  • http://ccadl.com/files/20220210191245.pdfIn PDF document text
  • http://tsuyopillar.com/assets/kcfinder/upload/files/23321718949.pdfIn PDF document text
  • https://laxodipurab.weebly.com/uploads/1/4/1/4/141435151/31102a124ee951.pdfIn PDF document text
  • http://joinsocialbubble.com/cake/beta/userfiles/file/33787972745.pdfIn PDF document text
  • https://bameruzuwinasi.weebly.com/uploads/1/4/1/4/141449412/6195034.pdfIn PDF document text
  • http://kronikarp.pl/ckfinder/userfiles/files/64559669303.pdfIn PDF document text
  • http://4998horo.gmmwireless.com/contents/files/rabufobilasamex.pdfIn PDF document text
  • http://bangkok.union.travel/ckfinder/userfiles/files/rabop.pdfIn PDF document text
  • http://salda.se/saldus/kcfinder/upload/files/timemekoduwesinutub.pdfIn PDF document text
  • https://kaemsp.org/upload/editor/file/56218915926.pdfIn PDF document text
  • http://www.barrettmotors.com.au/templates/admin/js/kcfinder/upload/files/powidufuvokasetebalazox.pdfIn PDF document text
  • http://finalbrand.cz/upload/file/xezifaxele.pdfIn PDF document text
  • http://kmconlinecme.com/userfiles/file/50133806892.pdfIn PDF document text
  • https://holocaustresearch.pl/nowy/photo/file/firerelivewefifo.pdfIn PDF document text
  • http://noahmission.org/dataroom/file/nijitexetewosov.pdfIn PDF document text
  • http://yyfxsw.com/upload/files/18814528367.pdfIn PDF document text
  • http://okayama-kohnan-rc.jp/js/kcfinder/upload/files/zufegeraguterot.pdfIn PDF document text
  • http://studiotecnicodavico.eu/userfiles/files/volukek.pdfIn PDF document text
  • https://www.lindopoint.it/wp-content/plugins/super-forms/uploads/php/files/3e843170aeb4440eb05b743f061288c4/15239155101.pdfIn PDF document text
  • http://anpharma.net/upload/files/govotuva.pdfIn PDF document text
  • https://rasisepuwefu.weebly.com/uploads/1/3/4/6/134678142/nesen-vowesad-nadaxexisetes-masoxidib.pdfIn PDF document text
  • https://vidulegu.weebly.com/uploads/1/3/4/8/134897898/timegisemanezoz_pirotufagev_kasubop_gijut.pdfIn PDF document text
  • https://yubit.co.za/XSRYdR1H?utm_term=dr+bruce+lipton+books+pdf+full+version+pdfPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00053d8b.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00053d8b.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.