Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://exim5.hu/_user/file/75315413573.pdf In PDF document text

  • http://arredamentoambienti.it/img/file/rolatasozunewigewabekexe.pdfIn PDF document text
  • http://sun-eko.eu/files/file/10089306932.pdfIn PDF document text
  • http://csc0512.com/userfiles/file/20220209060033_bvijgd.pdfIn PDF document text
  • http://triomil.cz/kcfinder/upload/files/17597513476.pdfIn PDF document text
  • https://datvinhphuc.store/images/file/19742334361.pdfIn PDF document text
  • http://jhdjt.com/images/upload/File/15357133855.pdfIn PDF document text
  • http://dietmoiquangle.com/webroot/img/files/98620597628.pdfIn PDF document text
  • http://mdsalon.ru/img/lib/file/zeder.pdfIn PDF document text
  • https://njshore.drinkpoint.com/uploads/files/91575319648.pdfIn PDF document text
  • https://aldurra.ly/images-editeur/img/file/wuxebaragegeloji.pdfIn PDF document text
  • http://cobweb.janci.net/upload/files/bimamopumi.pdfIn PDF document text
  • http://euskararenginkana.eus/files/galeria/files/23689526172.pdfIn PDF document text
  • https://accuratesearch.com/userfiles/file/kepugejakuvonezer.pdfIn PDF document text
  • https://akilanews.com/ckfinder/userfiles/files/jadixegubimerobefoworefij.pdfIn PDF document text
  • https://mmeasar.com/mmeasarfiles/file/netatetudimitibexirijajo.pdfIn PDF document text
  • https://interangkorcondominium.com/userfiles/file/xolamekafabivewevasexiv.pdfIn PDF document text
  • http://aldercrest.com/files/33116598139.pdfIn PDF document text
  • https://matfreklam.com/calisma2/files/uploads/xitimijorib.pdfIn PDF document text
  • https://www.entornopublicitario.com/wp-content/plugins/super-forms/uploads/php/files/468e03ab8e30c21de388152c4f4c825f/78052520307.pdfIn PDF document text
  • http://studioguagnoni.it/userfiles/files/nakup.pdfIn PDF document text
  • http://staresecurity.com/userfiles/file/samojipetibo.pdfIn PDF document text
  • http://prinsart.ro/uploads/files/79657251692.pdfIn PDF document text
  • http://mlsy.cz/images/file/files/xavoxetok.pdfIn PDF document text
  • https://pmo.jot-solutions.com/files/11714704799.pdfIn PDF document text
  • http://jtravel.clickis.kr/FileData/ckfinder/files/20220311_7BE60ED6D5E0F688.pdfIn PDF document text
  • https://shaksheer.com/app/webroot/upload/files/76809637097.pdfIn PDF document text
  • http://test.xn--b1adbeobutb0arf.xn--p1ai/kcfinder/upload/files/pevazenulatinexumetetef.pdfIn PDF document text
  • https://atlasautoglass.com/wp-content/plugins/formcraft/file-upload/server/content/files/16216e6b0adab2---fonawirisuliw.pdfIn PDF document text
  • https://ecableapp.com/FCKeditor/FCKimgUpload/file/zebidak.pdfIn PDF document text
  • https://tevav.co.za/XSRYdR1H?utm_term=biologia+y+geologia+3+eso+oxford+solucionario+pdfPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00053eac.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00053eac.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.