Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
  Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
• Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
  Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
• SEO-redirector lure link (multi-word utm_term) low PDF_SEO_UTM_REDIRECTOR_LINK
  PDF contains a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the search-keyword gateway used by the 'free document download' phishing family. Surfaced as an IOC; on its own this is a low-confidence signal.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://yoyep.co.za/XSRYdR1H?utm_term=teamviewer++mac+13 PDF link annotation

  • http://alacarte-grafik.de/userfiles/file/wixuravazis.pdfIn PDF document text
  • https://bio-obst-und-gemuese.de/userfiles/file/19023610662.pdfIn PDF document text
  • https://texexodova.weebly.com/uploads/1/3/0/9/130970004/2681419.pdfIn PDF document text
  • https://gizaviation.com/uploads/files/91943546826.pdfIn PDF document text
  • http://anaheim81.com/kcfinder/upload/files/vimugajopuzibazuwetukir.pdfIn PDF document text
  • http://uveteknik.com/uploads/files/12550570374.pdfIn PDF document text
  • https://snpwachq.com/files/js/ckfinder/userfiles/files/lotevidavibibupe.pdfIn PDF document text
  • https://find-domain.lazy-online-shop.com/app/webroot/userfiles/files/17365279467.pdfIn PDF document text
  • https://bozusobogopi.weebly.com/uploads/1/3/2/7/132711975/5199479.pdfIn PDF document text
  • https://tufibexewati.weebly.com/uploads/1/3/4/5/134583298/razipezinu_rosozu_nevesojeben_bimexudo.pdfIn PDF document text
  • http://dreamscar.eu/userfiles/file/87906580688.pdfIn PDF document text
  • https://mainangacor.com/contents/files/29821005049.pdfIn PDF document text
  • https://www.sidertest.it/wp-content/plugins/formcraft/file-upload/server/content/files/1625b927fcb0dc---falemavevugovudutateruwob.pdfIn PDF document text
  • https://avistravel.activsport.ro/userfiles/file/72796098860.pdfIn PDF document text
  • https://hk-delight.com/UploadFiles/file/40910164896.pdfIn PDF document text
  • http://vitanova-cattery.com/upload/file/loketikaf.pdfIn PDF document text
  • http://trailerdepot.ca/site-uploads/bikisi.pdfIn PDF document text
  • http://conserviabd.com/assets/ckeditor/kcfinder/upload/files/lepekusobudixewarolu.pdfIn PDF document text
  • http://cukiernia.eu/upload/files/77360689686.pdfIn PDF document text
  • https://wufaxewixebel.weebly.com/uploads/1/3/5/3/135302410/1014933.pdfIn PDF document text
  • https://protradingindia.net/userfiles/file/59772323757.pdfIn PDF document text
  • https://fitxpower.fr/lib/ckeditor/kcfinder/upload/files/18738002184.pdfIn PDF document text
  • http://www.alite.com.br/assets/kcfinder/upload/files/41223468040.pdfIn PDF document text
  • http://noithattamphuong.com/upload/files/13588700879.pdfIn PDF document text
  • https://rn62ug59c-to8.com/contents/files/puximepobusuvulofegame.pdfIn PDF document text
  • https://tommytest.dish1314.com/data/html_editor/files/18263900161.pdfIn PDF document text
  • http://lingvastar.z-i-g-z-a-g.com/userfiles/files/golixokisukonufo.pdfIn PDF document text
  • https://dezusopivelisuk.weebly.com/uploads/1/3/4/7/134734284/wudezopepam.pdfIn PDF document text
  • http://biosurfest.com/userfiles/files/lajarovore.pdfIn PDF document text
  • http://ebiddex.com/kcfinder/upload/files/wokasunilaxobo.pdfIn PDF document text
  • https://pewidujatiw.weebly.com/uploads/1/3/1/3/131381722/c934a88267acf6.pdfIn PDF document text
  • https://www.giromarilia.com.br/plugins/kcfinder/upload/files/purusurof.pdfIn PDF document text
  • https://rockvalleytravel.net/files/files/62953434700.pdfIn PDF document text
  • https://quangcaowebsite.xemlaco.com/uploads/files/norojozubewofum.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0004a470.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0004a470.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.