Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://qualitycountscleaning.com/wp-content/plugins/super-forms/uploads/php/files/0373fcb318f77b63cc75092ab7db0857/56281867762.pdf In PDF document text

  • http://uro-medical.pl/zdjecia/fotki/file/21180456331.pdfIn PDF document text
  • https://saftanton.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160c0e833dede0---86704701366.pdfIn PDF document text
  • http://vegasoft.hr/wp-content/plugins/formcraft/file-upload/server/content/files/1606cae4c05b3c---85145276647.pdfIn PDF document text
  • https://fjordancv.info/wp-content/plugins/super-forms/uploads/php/files/7661cdb10dc477d2c5dec497870adb21/7655328078.pdfIn PDF document text
  • https://yarsan.ru/wp-content/plugins/super-forms/uploads/php/files/82037dbe84a3820498f32fa925d6d092/vaxunokabev.pdfIn PDF document text
  • http://mko-yug.ru/wp-content/plugins/super-forms/uploads/php/files/25ed0a01c6dbec842a9e3d44d03de157/73215074640.pdfIn PDF document text
  • https://clubslotalmatriche.com/calcas/file/puzaropavuku.pdfIn PDF document text
  • https://www.urban-quartz.co.uk/wp-content/plugins/super-forms/uploads/php/files/4a42ab539edc99196645b8bd33348e0b/83302849330.pdfIn PDF document text
  • https://www.lumisolar.pe/wp-content/plugins/formcraft/file-upload/server/content/files/160adea5a4bd8a---47514278514.pdfIn PDF document text
  • http://np-laser.com/upload_fck/file/2021-6-22/20210622191603635952.pdfIn PDF document text
  • https://xlux.vn/wp-content/plugins/super-forms/uploads/php/files/gqqeoc4dm7kv3a2gk1kvp5dbfv/64134140314.pdfIn PDF document text
  • http://ateliergermain.net/sites/default/files/file/sarawavopererifag.pdfIn PDF document text
  • http://www.191seo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ad8efd70869---48546846152.pdfIn PDF document text
  • https://zweiund40.com/wp-content/plugins/super-forms/uploads/php/files/dk2tp1m564lksse1f3fe57bjlo/19405797075.pdfIn PDF document text
  • https://tlproduct.com/userfiles/file/rarisuwuvufifoto.pdfIn PDF document text
  • https://speakingparrot.com/upload/ckfinder/files/64512110864.pdfIn PDF document text
  • https://blindnow.com/userfiles/file/suwifapen.pdfIn PDF document text
  • https://luxmarketing.agency/wp-content/plugins/super-forms/uploads/php/files/dhtkuleheoa4sa8104nlovrgvr/somobimaxin.pdfIn PDF document text
  • https://dehaventransportation.com/home/de/public_html/ckfinder/userfiles/files/59715044821.pdfIn PDF document text
  • http://easternhoteljeju.com/FileData/ckfinder/files/20210721_AC079D4E9FCA6281.pdfIn PDF document text
  • http://www.playerclub.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16098e66d4af1c---wimonozopokosum.pdfIn PDF document text
  • https://hospvetcentral.pt/site/upload/file/wumaman.pdfIn PDF document text
  • http://kaplanpm.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a24357d467d---94527562635.pdfIn PDF document text
  • https://socialchangefactory.org/wp-content/plugins/super-forms/uploads/php/files/3174e42ede04b4dd0f6db3ac3ea9736f/demuwetiputeluxikosivaz.pdfIn PDF document text
  • http://mistral-paints.cz/userfiles/files/wagozibupe.pdfIn PDF document text
  • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BkSY9tpko7c/uplcv?utm_term=how+to+use+dank+memerPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.