Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
  Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://sunuf.co.za/XSRYdR1H?utm_term=cloze+comprehension+worksheets PDF link annotation

  • http://www.crislbd.com/public/admin/assets/ckeditor/kcfinder/upload/files/21957171960.pdfIn PDF document text
  • http://naphotelbangkok.com/userfiles/files/miretatewonew.pdfIn PDF document text
  • https://www.sabiamente.es/wp-content/plugins/formcraft/file-upload/server/content/files/1622eafe4f2db6---51476169347.pdfIn PDF document text
  • http://nenayu.com/filespath/files/20220223220719.pdfIn PDF document text
  • https://asid.rw/userfiles/file/85317678432.pdfIn PDF document text
  • http://bagiez.com/userfiles/file/rejepolekanemifajiwep.pdfIn PDF document text
  • https://xajekedifa.weebly.com/uploads/1/3/4/4/134469171/9706698.pdfIn PDF document text
  • https://dudulisatosix.weebly.com/uploads/1/3/1/6/131637211/5938513.pdfIn PDF document text
  • http://ctcinsulator.com/uploads/file/42355924085.pdfIn PDF document text
  • https://difadasitaga.weebly.com/uploads/1/4/1/4/141494494/zojibufogipexezex.pdfIn PDF document text
  • https://panama4d.com/contents/files/gobasojunigu.pdfIn PDF document text
  • http://www.banzolaassociati.com/gestlab/kcfinder/upload/files/55636623214.pdfIn PDF document text
  • https://wiercenie-studni24.pl/files/files/xaresapunexedegefigizokaw.pdfIn PDF document text
  • http://www.dispatchls.com/backend/web/kcfinder/upload/files/82407004010.pdfIn PDF document text
  • http://chmer.yun2u.com/upload/files/xetukarekajofadipizowe.pdfIn PDF document text
  • http://elitvorota.ru/f/file/58478312318.pdfIn PDF document text
  • https://gazezujebek.weebly.com/uploads/1/3/4/8/134881616/lerop.pdfIn PDF document text
  • https://walisisatar.weebly.com/uploads/1/3/4/5/134576301/1607987.pdfIn PDF document text
  • https://zapret-rf.org/web/img/podborky/files/39408948554.pdfIn PDF document text
  • http://www.iccet.org.tr/kcfinder/upload/files/67212989140.pdfIn PDF document text
  • http://www.chatanakonci.cz/userfiles/file/11302674334.pdfIn PDF document text
  • http://vinhthuan.asia/upload/files/lixubigedopabomobadukaxo.pdfIn PDF document text
  • https://sangogiaphuc.com/admin/webroot/upload/image/files/magibekatiwe.pdfIn PDF document text
  • https://www.anoregmt.org.br/ckeditor/ckfinder/userfiles/files/xolax.pdfIn PDF document text
  • http://gesht.ru/admin/ckfinder/userfiles/files/xutij.pdfIn PDF document text
  • https://xexajuxeleseg.weebly.com/uploads/1/3/4/5/134592224/1982958.pdfIn PDF document text
  • https://faxemidarasagim.weebly.com/uploads/1/3/4/3/134341424/8506790.pdfIn PDF document text
  • http://charmingcurls.se/upload/file/13417531601.pdfIn PDF document text
  • https://siemens-rozetki.ru/kcfinder/upload/files/66501086929.pdfIn PDF document text
  • https://sujexixapobitu.weebly.com/uploads/1/3/4/3/134328704/fatol.pdfIn macro / runtime command snippet
  • http://ptd-tver.ru/content/files/upload/files/feragofir.pdfIn PDF document text
  • http://studiomilano.eu/userfiles/files/raxukonorux.pdfIn PDF document text
  • http://grandp.ru/userfiles/file/rukenovifebezimafirak.pdfIn PDF document text
  • https://indian-sped.szabgab.hu/fck_uploads/pdf/15592666306.pdfIn PDF document text
  • https://samsungklimamodelleri.com/upload/ckfinder/files/vamek.pdfIn PDF document text
  • https://www.bevillelecomte.com/ckfinder/userfiles/files/64321121614.pdfIn PDF document text
  • https://bahceneryaman.net/public/content-images/files/xibodez.pdfIn PDF document text
  • https://siemens-rozetkiIn macro / runtime command snippet
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.