Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://levant-tekstil.com/other_files/File/xodeloxotuxuzaxetowe.pdf In PDF document text

  • https://buka.ru/sadm_files/57805172501.pdfIn PDF document text
  • http://mgtuae.com/uploads/file/dudopipizebifuvositi.pdfIn PDF document text
  • http://salamino.pl/userfiles/file/43065272346.pdfIn PDF document text
  • http://comlark.ru/userfiles/files/59179602657.pdfIn PDF document text
  • http://tuclubcr.com/campannas/file/wafasetoguvemikutupaxoge.pdfIn PDF document text
  • http://nelly-design.ru/upload/files/niwixonedakuponelatamo.pdfIn PDF document text
  • https://auditorescr.com/ckfinder/userfiles/files/buxozajaxavek.pdfIn PDF document text
  • http://aaexpansionjoint.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621ef9dd87ba0---3022562047.pdfIn PDF document text
  • http://thietbiotovn.com/Images_upload/files/51926977036.pdfIn PDF document text
  • https://masterpieces-mallorca.com/wp-content/plugins/super-forms/uploads/php/files/30a4bc70f3502b3a7afb5266f8fb8b5f/4440821861.pdfIn PDF document text
  • https://successstudio.net/userfiles/file/xonavisifudodi.pdfIn PDF document text
  • http://blackswaninfotech.com/kcfinder/upload/files/29456019210.pdfIn PDF document text
  • http://shbaicun.com/userfiles/file/2022020113322173499.pdfIn PDF document text
  • http://reklamnizbozi.cz/data/upload/files/40999739636.pdfIn PDF document text
  • https://cakesandcupcakes.net/userfiles/files/popateniwisebijarek.pdfIn PDF document text
  • https://luxury77.com/kcfinder/upload/files/4490376594.pdfIn PDF document text
  • http://vita24h.com/uploads/userfiles/file/pulorexawuwofesusinod.pdfIn PDF document text
  • http://pro-customer.de/userfiles/file/zexudumejuvila.pdfIn PDF document text
  • https://wsbe17hongkong.hk/_bin/ckfinder/userfiles/files/xupudezunaxavutaxixa.pdfIn PDF document text
  • http://raiz.jp/kcfinder/upload/files/sulotedenalideporifutazas.pdfIn PDF document text
  • http://alompar.hu/uploads/content_files/files/6070366821.pdfIn PDF document text
  • https://atlaskvartir.ua/data/uploads/files/xunedorezi.pdfIn PDF document text
  • https://fontaine-eva.fr/userfiles/files/bisapipemiwidilotov.pdfIn PDF document text
  • http://gamax-moto.cz/data/dokumenty/luzifigozor.pdfIn PDF document text
  • http://jmvlpslimited.com/ci/userfiles/files/tivufolesijofenegile.pdfIn PDF document text
  • https://esofagopisa.it/userfiles/file/20490054867.pdfIn PDF document text
  • http://garant-fond.ru/ckeditor/ckfinder/userfiles/Images/files/vegadixebawojotenufafunu.pdfIn PDF document text
  • https://festacontinua.it/public/file/55450412651.pdfIn PDF document text
  • http://csc028.com/userfiles/file/20220216134818_r63u6z.pdfIn PDF document text
  • http://wyadonline.com/userfiles/file/jipifubefesixumugoxu.pdfIn PDF document text
  • https://landviewdesign.com/userfiles/file/kapitorotizizabevo.pdfIn PDF document text
  • http://asesoriagarpe.com/wp-content/plugins/formcraft/file-upload/server/content/files/1622d081b0dc11---40343649927.pdfIn PDF document text
  • http://msiutilities.biz/documents/zokisugaz.pdfIn PDF document text
  • https://roundtable106trust.org/admin/uploads/file/wituvon.pdfIn PDF document text
  • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/162115def37b5c---16875386986.pdfIn PDF document text
  • https://www.andyselfstorage.co.uk/wp-content/plugins/super-forms/uploads/php/files/f713iuhlee21b9khka63u0ajk4/zomumeze.pdfIn PDF document text
  • http://qdy.sdsgs.com/userfiles/file/20672772771.pdfIn PDF document text
  • https://norin.co.za/XSRYdR1H?utm_term=phonics+worksheet+for+3rd+gradePDF link annotation
  • http://boryspil.osp-ua.info/userfiles/file/39302445616.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00049e96.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00049e96.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.