Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://lazav.co.za/XSRYdR1H?utm_term=bim+project+execution+planning+guide+and+templates+%E2%80%93+version+2.1 PDF link annotation

  • https://xefezovunir.weebly.com/uploads/1/3/4/6/134623549/wibafuluzumeve-bupop-lemosave-zakakup.pdfIn PDF document text
  • https://gentrilieu.vn/userfiles/file/kovowerevewivufebiteme.pdfIn PDF document text
  • https://viraporu.weebly.com/uploads/1/3/5/3/135335981/6147947.pdfIn PDF document text
  • http://japhina.com/upload/file/48224350016.pdfIn PDF document text
  • https://pagudibaxite.weebly.com/uploads/1/3/1/4/131410234/28ad1a198fa.pdfIn PDF document text
  • https://najibiwamedixi.weebly.com/uploads/1/3/4/9/134901652/6084367.pdfIn PDF document text
  • http://giayviettri.com/img-ftec/files/74249890398.pdfIn PDF document text
  • https://vunojomilubokub.weebly.com/uploads/1/3/0/7/130775688/d1266.pdfIn PDF document text
  • https://ravijirigiraga.weebly.com/uploads/1/3/4/6/134649302/vafolosafanaxoz.pdfIn PDF document text
  • http://czyxchem.com/upload/files/29552596913.pdfIn PDF document text
  • https://lajakobu.weebly.com/uploads/1/3/4/5/134599687/5165092.pdfIn PDF document text
  • https://mifeweravu.weebly.com/uploads/1/3/0/8/130874314/c3b7cb71.pdfIn PDF document text
  • http://bigbulkbags.com/survey/userfiles/files/dobuxumolap.pdfIn PDF document text
  • https://duguzimelape.weebly.com/uploads/1/3/4/6/134666192/letutamejawuvitumebu.pdfIn PDF document text
  • https://sisilodoja.weebly.com/uploads/1/3/1/4/131406442/9251014.pdfIn PDF document text
  • https://kurek-rowery.pl/user_pict/file/9768485925.pdfIn PDF document text
  • http://www.velkoobchod-man.eu/ckfinder/userfiles/files/mapuxomejuxev.pdfIn PDF document text
  • https://sovezoku.weebly.com/uploads/1/3/4/7/134731827/kudixefiku.pdfIn PDF document text
  • http://jysfh.com/upload_fck/file/2022-2-20/20220220141507867175.pdfIn PDF document text
  • https://nofefikow.weebly.com/uploads/1/3/4/5/134510094/buwemeweboluzu-forole.pdfIn PDF document text
  • https://favaruzikab.weebly.com/uploads/1/3/4/8/134871436/d9cd9a5.pdfIn PDF document text
  • https://kupovujegala.weebly.com/uploads/1/3/5/3/135395018/e06255b3c4682.pdfIn PDF document text
  • https://rotolakudezi.weebly.com/uploads/1/3/4/0/134041133/vakekobipe.pdfIn PDF document text
  • https://sutujiwujuso.weebly.com/uploads/1/3/5/3/135390810/7040748.pdfIn PDF document text
  • http://asvpp.fr/pdf/11137326517.pdfIn PDF document text
  • https://banalixigadevub.weebly.com/uploads/1/3/4/7/134722660/bd6a1.pdfIn PDF document text
  • http://mathcountsoutreach.org/userfiles/file/fabaxukuruxalamaku.pdfIn PDF document text
  • https://gitumakiwu.weebly.com/uploads/1/3/1/4/131437138/nakototi.pdfIn PDF document text
  • https://jozisanolotodix.weebly.com/uploads/1/3/0/9/130969335/6508962.pdfIn PDF document text
  • https://vugevosuza.weebly.com/uploads/1/3/5/3/135328642/868289.pdfIn PDF document text
  • https://falototadapi.weebly.com/uploads/1/3/3/9/133989324/nagizekavetufa.pdfIn PDF document text
  • https://pidofuvu.weebly.com/uploads/1/3/0/7/130739764/gufom-bejog-rawisema.pdfIn PDF document text
  • http://giasuthienphuc.com/Images_upload/files/46867589887.pdfIn PDF document text
  • http://nprofit.hk/userfiles/sujamutowelajogi.pdfIn PDF document text
  • https://nidedijuba.weebly.com/uploads/1/3/0/8/130814831/8677101.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0004d550.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0004d550.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.