Malicious PDF — malware analysis report

Heuristics 9

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PHP webshell / backdoor source critical WEBSHELL_PHP
  The file contains PHP server-side code with the signature of a webshell/backdoor (named PHP webshell banner (madspot)). A webshell takes attacker input from an HTTP request and runs commands/code on the server. Flagged as a malicious hacktool artifact even when carried inside a document or archive — the code does not execute from the carrier, but the file is a webshell.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Embedded JS stream low PDF_JS
  PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://lazav.co.za/XSRYdR1H?utm_term=use+of+reported+speech+in+english+grammar PDF link annotation

  • https://insolite.lu/img/userfiles/files/nuxumanimutunitewu.pdfIn PDF document text
  • http://elenasteele.com/wp-content/plugins/formcraft/file-upload/server/content/files/161f61eea0f55a---zajumupemodevakuros.pdfIn PDF document text
  • https://mapithanhcong.com/upload/ck/files/19721967676.pdfIn PDF document text
  • https://wotfiles.com/ckfinder/userfiles/files/46718690153.pdfIn PDF document text
  • http://aliancegroup.su/wp-content/plugins/formcraft/file-upload/server/content/files/161ed6d570c0bf---zuwofute.pdfIn PDF document text
  • http://www.hj-bouwt.be/wp-content/plugins/formcraft/file-upload/server/content/files/161125ab21e116---27536272574.pdfIn PDF document text
  • https://eastoncn.housemember.com/uploads/files/51030579859.pdfIn PDF document text
  • http://runnersavezzano.it/public/userfiles/file/2723146244.pdfIn PDF document text
  • http://uleshuzatshop.hu/files/file/kusekegi.pdfIn PDF document text
  • http://pate4me.com/userfiles/file/berorakog.pdfIn PDF document text
  • http://moveisgarciadigital.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1611f7abf79c58---xibowuri.pdfIn PDF document text
  • https://hongmao.tw/uploads/files/202111071415449042.pdfIn PDF document text
  • https://www.olympusnorge.no/wp-content/plugins/super-forms/uploads/php/files/3i3c4dfl0h636t3kr21toh1suf/zopolufun.pdfIn PDF document text
  • http://tcgardening.com/userfiles/file/2021121620011973499.pdfIn PDF document text
  • https://nnt52.ru/userfiles/file/dawefa.pdfIn PDF document text
  • http://elfobchod.cz/foto/Image/file/82684708271.pdfIn PDF document text
  • http://xn--82ca1bkibi6eufn5bh1b7i3e.com/UserFiles/File/dulutuxofozefewubogotoda.pdfIn PDF document text
  • http://www.shjkyq.com/up_files/FCK/file/56065932587.pdfIn PDF document text
  • http://argentum.com/wp-content/plugins/super-forms/uploads/php/files/85nhlunsgj15fffqd7tgkavmt4/78478939071.pdfIn PDF document text
  • https://phatgiaolongan.com/upload/ckupload/files/8840631406.pdfIn PDF document text
  • http://redskap.ru/userfiles/file/fozug.pdfIn PDF document text
  • http://automyjka.pl/automyjka.pl/userfiles/file/29091097794.pdfIn PDF document text
  • http://everettsbarbque.com/clients/b/b0/b0b566c85bab127526a414587b81487f/File/79718144077.pdfIn PDF document text
  • http://bienchidan.org/uploads/files/papenifuweminobaviduf.pdfIn PDF document text
  • http://samuiluxurytravel.com/Uploads/file/86299121469.pdfIn PDF document text
  • https://basundharamart.com/userfiles/file/24831925687.pdfIn PDF document text
  • https://messianic.live/wp-content/plugins/super-forms/uploads/php/files/5734ef0c6dc995dcff01df8834a9d2dd/72628942967.pdfIn PDF document text
  • http://admio.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16143b4bf98ee8---neperakegadavuwotaki.pdfIn PDF document text
  • http://hotelparkplaza.in/app/webroot/js/kcfinder/upload/files/pezurotozevekusujigukif.pdfIn PDF document text
  • https://actionalbertafoundationrepair.com/nbloom/fckuploads/file/75067262655.pdfIn PDF document text
  • https://klubkanine.com/home/klub/public_html/ckfinder/userfiles/files/17936814313.pdfIn PDF document text
  • https://madspot.dk/ckfinder/userfiles/files/kifuzovorazetofi.pdfIn PDF document text
  • https://mkserwis.pl/userfiles/file/16201725.pdfIn PDF document text
  • http://www.ausafrica.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160ee88bc853f5---94075806005.pdfIn PDF document text
  • https://burlingame.com/wysiwygfiles/file/zubim.pdfIn PDF document text
  • https://ctapigroup3.com/contents/files/xozupomibivef.pdfIn PDF document text
  • http://www.vinoplaza.nl/img/upload/files/fevabigexizubisobipiwusol.pdfIn PDF document text
  • https://cruiseship.cruises/wp-content/plugins/super-forms/uploads/php/files/8a45ncaem0nqkeq5mu0g2lis80/voforobakowaburususas.pdfIn PDF document text
  • https://livstyle.ro/home/livstyle/public_html/uploads/files/82011613653.pdfIn PDF document text
  • http://studiotipaldo.com/userfiles/files/vitifobijuvu.pdfIn PDF document text
  • https://stakeoutllc.com/wp-content/plugins/super-forms/uploads/php/files/66a6564167ea8be906a70bd55eb55649/79107210169.pdfIn PDF document text
  • https://hattshopping.com/admin/assets/images/ckfiles/situvekular.pdfIn PDF document text
  • http://dreamsurgerycn.com/ckupload/files/nanuvojeza.pdfIn PDF document text
  • http://alvitraders.com/files/zukujufibikimuwuvubi.pdfIn PDF document text
  • https://galerie-louise.be/userfiles/files/vuninupezizibonawut.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text

  +4 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.