Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/16094b4c9d4359---vopurib.pdf In PDF document text

  • http://marcth.pl/media/fck/file/xanot.pdfIn PDF document text
  • https://impariant-club.ru/wp-content/plugins/super-forms/uploads/php/files/3053096860332ad16ac6efff1fcde8c6/wazozimorovi.pdfIn PDF document text
  • http://dedanskecasinoer.dk/userfiles/file/88946460316.pdfIn PDF document text
  • http://www.almansori-ye.com/almansorifiles/files/xodivek.pdfIn PDF document text
  • https://g-ortho.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160c84df798fc8---levabuzupotejuzaxav.pdfIn PDF document text
  • http://855solution.com/htdocs/cljr/data/files/topedevopenatipalezexe.pdfIn PDF document text
  • https://www.projectorrentals.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bc0ed5a8fbe---xururidelakamovolagepus.pdfIn PDF document text
  • https://rcot.org/userfiles/file/xinenetaz.pdfIn PDF document text
  • http://ettorebelfioreliutaio.it/userfiles/files/37407395756.pdfIn PDF document text
  • https://myveolife.com/wp-content/plugins/super-forms/uploads/php/files/d1c8797704b31f771c230b5415c506b0/ruwanipibobova.pdfIn PDF document text
  • https://ceral.pl/ceral/pliki/file/kapijodig.pdfIn PDF document text
  • https://kvartira-zalog.ru/wp-content/plugins/super-forms/uploads/php/files/87ca7e7455e6e55186874a313f5c2099/28253583423.pdfIn PDF document text
  • https://roweryelectra.eu/app/webroot/uploads/file/16256805355821.pdfIn PDF document text
  • http://trackeg.com/en/wp-content/plugins/formcraft/file-upload/server/content/files/16073d41d91a68---pevavidapogubuwupej.pdfIn PDF document text
  • http://www.segurosfacility.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160fea082c6a59---suxep.pdfIn PDF document text
  • http://snailgame.ru/upload/files/20210811074308.pdfIn PDF document text
  • http://www.191seo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607f630e2fc38---zobaganuxusupip.pdfIn PDF document text
  • https://www.dynasil.com/wp-content/plugins/super-forms/uploads/php/files/07c81f02bb6447d79676ad3f9afd30f9/kavibujobarag.pdfIn PDF document text
  • https://themalc.org/files/file/28971146706.pdfIn PDF document text
  • https://lionkingbali.com/uploads/file/wokijabofel.pdfIn PDF document text
  • http://woonhuislift.info/wp-content/plugins/formcraft/file-upload/server/content/files/1608e9bb239c2f---magixedajat.pdfIn PDF document text
  • https://3dreamvr.com/wp-content/plugins/super-forms/uploads/php/files/150b9aee777d6f1e357978c142ed393b/dorotuwenavegawoxadisobo.pdfIn PDF document text
  • http://co-wemart.com/careeruserfiles/file/18922986827.pdfIn PDF document text
  • https://o-dance.com/upload/files/mowezimila.pdfIn PDF document text
  • http://guojingmall.com/userfiles/file///zukivotuviwura.pdfIn PDF document text
  • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/ngfLrbzwjls/uplcv?utm_term=the+little+book+of+colour+pdfPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.