Malicious PDF — malware analysis report

Heuristics 5

• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://wastran.ru/uplcv?utm_term=formula+for+specific+latent+heat+of+vaporization PDF link annotation

  • https://feniks9.ru/ckfinder/userfiles/files/60911934249.pdfIn PDF document text
  • https://coloreverything.love/wp-content/plugins/super-forms/uploads/php/files/de02930afc750362dedc14d4613094b0/74874156810.pdfIn PDF document text
  • http://middlegeorgiacoinclub.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606eb1c7e1798---87031047109.pdfIn PDF document text
  • https://thesmithgrouphouston.com/wp-content/plugins/super-forms/uploads/php/files/a4a012252021453dda535e71939a1b37/52675229111.pdfIn PDF document text
  • http://cheers-gifts.com/userfiles/37051192131.pdfIn PDF document text
  • https://laser-arena.ch/wp-content/plugins/formcraft/file-upload/server/content/files/160745af2161d8---padajapipivujesakerin.pdfIn PDF document text
  • https://izharfoster.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608f7bc1ae03c---68758233246.pdfIn PDF document text
  • https://www.gs-gleichmann.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607c9e1f7fcfd---53904620985.pdfIn PDF document text
  • https://www.andimoda.com/wp-content/plugins/super-forms/uploads/php/files/9d9f945dce03d33bd7ede78fef3956cd/43789298934.pdfIn PDF document text
  • http://surtek.biz/image/files/20150120_083651.pdfIn PDF document text
  • https://cgeminfos.ma/upload/file/61909084815.pdfIn PDF document text
  • http://wbbray.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b4b8a319e5e---pelodonajosarofewedubu.pdfIn PDF document text
  • https://teenvolunteerdallas.org/wp-content/plugins/super-forms/uploads/php/files/e1382ea22f38bd4054196526b1167972/finejedujevur.pdfIn PDF document text
  • https://www.yoursurveysurveyors.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160b9f231c3150---zuzopabuwada.pdfIn PDF document text
  • https://petroblend.com/wp-content/plugins/formcraft/file-upload/server/content/files/16079704a3a187---nimeliwibobi.pdfIn PDF document text
  • https://ivfnna.gr/wp-content/plugins/super-forms/uploads/php/files/2bfbfa5201a95c13e65a477b63afb1fb/jaduf.pdfIn PDF document text
  • https://slavica.ru/wp-content/plugins/super-forms/uploads/php/files/413e63c27e22000a17490cf0ead42336/43799416823.pdfIn PDF document text
  • https://globalazeri.az/wp-content/plugins/super-forms/uploads/php/files/domeg082mn64im594nvqlof391/97222973977.pdfIn PDF document text
  • https://krimgranit.ru/wp-content/plugins/super-forms/uploads/php/files/67a6850f813dfda142e83e4b015105c6/kekejodebevijiwefiw.pdfIn PDF document text
  • https://deewo.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a9faaaad6da---bumetaruvirugeligugewuki.pdfIn PDF document text
  • http://cleannshieldflorida.com/wp-content/plugins/super-forms/uploads/php/files/9402cd73d67467f82f7eabee78460dd2/71103788351.pdfIn PDF document text
  • http://verkoop-je-wagen.be/wp-content/plugins/formcraft/file-upload/server/content/files/160c8af302bca7---58746143102.pdfIn PDF document text
  • http://www.appsolutely.sg/wp-content/plugins/formcraft/file-upload/server/content/files/16088961cceb10---penuritizugilefadiv.pdfIn PDF document text
  • http://jonkmp.nl/img/cms/file/buzamix.pdfIn PDF document text
  • http://vitalenzyme.com/uploads/fckupload/file/73122694804.pdfIn PDF document text
  • http://www.kidnuri.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b682dbad5a6---jimeselamavobi.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.