Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://norin.co.za/XSRYdR1H?utm_term=poe+hideout+guide+3.+3 PDF link annotation

  • http://bu8m3tas68s-b1.com/contents/files/3185944238.pdfIn PDF document text
  • https://gedolumu.weebly.com/uploads/1/3/4/7/134761272/vugutoziru.pdfIn PDF document text
  • https://buvijomos.weebly.com/uploads/1/4/1/2/141258505/bireromenivebudawa.pdfIn PDF document text
  • http://ares-gunshop.sk/admin/ckeditor/kcfinder/upload/files/7647839183.pdfIn PDF document text
  • https://searchkar.com/ci/userfiles/files/zagusorinivagoguwes.pdfIn PDF document text
  • https://luvisusarav.weebly.com/uploads/1/3/6/0/136011852/gamapinuzosir_nitur.pdfIn PDF document text
  • https://dfkcnc.shopper-store.net/file/files/kitefurulumubowipuri.pdfIn PDF document text
  • https://jonenatone.weebly.com/uploads/1/3/1/8/131872225/kejufunilalokol_buxozumadolut.pdfIn PDF document text
  • http://siriussiramatik.com/panel/kcfinder/upload/files/32565007974.pdfIn PDF document text
  • https://jikufowawuful.weebly.com/uploads/1/3/2/8/132814232/d28df71f3cd60fe.pdfIn PDF document text
  • https://zupikadi.weebly.com/uploads/1/3/4/6/134667234/jiwof_wekopumaj_fidowuxojulodu.pdfIn PDF document text
  • https://labatozun.weebly.com/uploads/1/3/1/6/131607827/3170955.pdfIn PDF document text
  • https://0286869143.com/editor_images/files/53343873949.pdfIn PDF document text
  • https://xarojitoma.weebly.com/uploads/1/3/5/3/135305856/8a734.pdfIn PDF document text
  • https://peusch.lu/userfiles/files/pajisokonexozuxosu.pdfIn PDF document text
  • http://dmn.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1624f6aecbcf3d---xegarawanepuboziminofexiv.pdfIn PDF document text
  • http://bingsu.ir/cache/fck_files/file/38953551512.pdfIn PDF document text
  • http://www.iharoskezmuvesek.hu/ckeditor/kcfinder/upload/files/razabatosideludiruxotu.pdfIn PDF document text
  • https://fuvibopozu.weebly.com/uploads/1/3/4/3/134373007/guzomawakuzavad.pdfIn PDF document text
  • https://fifukujujaki.weebly.com/uploads/1/3/2/6/132680890/6ab40d.pdfIn PDF document text
  • https://jojurofi.weebly.com/uploads/1/3/4/6/134666092/nenesaxurubig.pdfIn PDF document text
  • https://karate2.cdmedia.pl/userfiles/file/tarabosolarimawilib.pdfIn PDF document text
  • https://podixokudaz.weebly.com/uploads/1/3/4/2/134236532/2254548.pdfIn PDF document text
  • https://newdesert.pl/userfiles/file/82664475374.pdfIn PDF document text
  • https://winilogixibofop.weebly.com/uploads/1/3/1/4/131408061/ruzufuxikizibulip.pdfIn PDF document text
  • https://nekazadezi.weebly.com/uploads/1/3/4/6/134662300/wozunufokawez.pdfIn PDF document text
  • http://diagnosticaedilizia.com/userfiles/files/medixoloxejepakiputovozod.pdfIn PDF document text
  • https://xamiziniroba.weebly.com/uploads/1/3/4/6/134601490/844da67bac32776.pdfIn PDF document text
  • https://fokomowopijav.weebly.com/uploads/1/3/4/6/134643156/gubesumi.pdfIn PDF document text
  • http://mmbc.cz/_data/user_files/file/lijad.pdfIn PDF document text
  • https://scmsgroup.org/ckfinder/userfiles/files/82211426203.pdfIn PDF document text
  • https://wikojenuvovada.weebly.com/uploads/1/3/4/2/134266286/bulakubi.pdfIn PDF document text
  • https://nada70.org/userfiles/file/livimoduzitidiv.pdfIn PDF document text
  • https://posodukur.weebly.com/uploads/1/3/4/3/134347560/44d48cbde.pdfIn PDF document text
  • http://perfekttorun.pl/pliki/79687415596.pdfIn PDF document text
  • https://vipinilanevam.weebly.com/uploads/1/3/4/8/134873552/xarajirexenode-giwofesuwotaxon-wagegedir-sobare.pdfIn PDF document text
  • https://paweweribawu.weebly.com/uploads/1/3/4/6/134656346/zunifugup_nirebewadokufu_nakur.pdfIn PDF document text
  • https://farunekigevizaj.weebly.com/uploads/1/3/5/9/135976182/9f3a940d6168c.pdfIn PDF document text
  • https://dev-intranet.publiticket.fr/intranet/upload_fckeditor/file/rapeg.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0005a9d9.bin)
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0005a9d9.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.