Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://www.suffaheducation.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a20653cc0a2---tawut.pdf In PDF document text

  • https://amirep.com/wp-content/plugins/super-forms/uploads/php/files/68412af0f0c72eabf96695bf8039c972/56296388178.pdfIn PDF document text
  • http://yuseigachi.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160a0226970303---18612166957.pdfIn PDF document text
  • https://fitnessrev.net/wp-content/plugins/super-forms/uploads/php/files/786vmulvfgmk1q2h9m1opt9juc/20632617988.pdfIn PDF document text
  • http://tuzvedo.hu/elemek/file/82217891225.pdfIn PDF document text
  • http://premiumresourcing.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084a21db3b09---93150728568.pdfIn PDF document text
  • http://www.mondzorgvesa-voorschoten.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1608d10af78ac0---rununedige.pdfIn PDF document text
  • https://www.alphaveneers.com/wp-content/plugins/super-forms/uploads/php/files/f79dcb7f10e1ee368abd9dfd42060fc7/48334805273.pdfIn PDF document text
  • https://asiatravel.kg/wp-content/plugins/super-forms/uploads/php/files/6ee334b61a138fe98dc97a3f6a1f2e20/91187531931.pdfIn PDF document text
  • http://exactblue.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a918fdd799c---60309123573.pdfIn PDF document text
  • http://pchs1967.com/clients/b/b3/b38b0c0be7ceca4b309dcb684d78a7c5/File/fikafe.pdfIn PDF document text
  • https://tkpmission.org/wp-content/plugins/formcraft/file-upload/server/content/files/1607d30b7acfed---87571372746.pdfIn PDF document text
  • http://www.goataxiservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608cd9fc94713---fetilubesaxarunarikalolef.pdfIn PDF document text
  • https://fortlauderdale-carservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/16088b180e96f9---62274658450.pdfIn PDF document text
  • https://laxmigrouppune.com/wp-content/plugins/super-forms/uploads/php/files/c69b66eca21e2ef74d95f898e60e2ae9/papixajokuxezabememas.pdfIn PDF document text
  • http://parkwestresidences.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072c886176c9---22135538490.pdfIn PDF document text
  • http://residencecarlofelice.com/userfiles/files/butetazumero.pdfIn PDF document text
  • https://maloneslandscape.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e0932d9a51---13167884033.pdfIn PDF document text
  • https://soba05.org/wp-content/plugins/super-forms/uploads/php/files/af1d0fc4f9bd2a6439a2dcf0c2659444/22059451679.pdfIn PDF document text
  • http://victoryelectricalsupply.com/ckfinder/userfiles/files/65695166663.pdfIn PDF document text
  • http://baanpowertrain.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609fff9df2ae8---98615726517.pdfIn PDF document text
  • https://www.myjamaicais.com/wp-content/plugins/super-forms/uploads/php/files/ba1acdb67c7ff548bd55ba6e07db76c6/93903135041.pdfIn PDF document text
  • http://nuyewrecruitment.com/wp-content/plugins/super-forms/uploads/php/files/bd28571dd7ef66558daf9c9365f1ba7a/12339633998.pdfIn PDF document text
  • http://alexlunacoach.com/img/editor/file/75958647077.pdfIn PDF document text
  • http://moestuinwebshop.nl/userfiles/file/begoxagoxinaduvinotan.pdfIn PDF document text
  • https://lightsourceindiana.com/wp-content/plugins/super-forms/uploads/php/files/91372e29400f966b6dd3a219ff22ddf9/jewevevoxosizu.pdfIn PDF document text
  • https://feedproxy.google.com/~r/skout/mBVl/~3/zMnd8XtcwSM/uplcv?utm_term=buildings+to+be+demolished+near+mePDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.