Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://www.alapan.org/fckimages/file/927663348.pdf In PDF document text

  • http://www.radiopopiatej.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a93fc2b48e7---63803610366.pdfIn PDF document text
  • https://wills.sg/wp-content/plugins/super-forms/uploads/php/files/387a673443592f457a736c5dee2808ca/vaxisivapokip.pdfIn PDF document text
  • http://pvsystreports.com/wp-content/plugins/super-forms/uploads/php/files/jv67m8brqf7eubva0hfcgj6ma2/52731257198.pdfIn PDF document text
  • http://philippinesroadshow.com/wp-content/plugins/super-forms/uploads/php/files/e07f5bdc29e487a5def59dc575601165/xatorakodo.pdfIn PDF document text
  • http://www.kizkulesikizogrenciyurdu.com/public/ckfinderuploads/files/49462506877.pdfIn PDF document text
  • https://www.northwoodmedical.ca/wp-content/plugins/super-forms/uploads/php/files/m4jncu9a7kapsktr5e3bvmp7fr/50740806456.pdfIn PDF document text
  • http://witnesstherealist.com/wp-content/plugins/super-forms/uploads/php/files/8ab81eadafc1f474b23fe379c6ac8bd1/gakexugakolegojadexudiku.pdfIn PDF document text
  • https://doitsolutions.co/wp-content/plugins/super-forms/uploads/php/files/73030f2cdf7d0719bcdf113dd97a9b54/27125375686.pdfIn PDF document text
  • http://nuyewpilot.academy/wp-content/plugins/super-forms/uploads/php/files/3f1f30ba9c2a55a4c20e2514623c9e77/59195586834.pdfIn PDF document text
  • https://www.syah.org/wp-content/plugins/super-forms/uploads/php/files/867d0dd70b1339bcd4b23a102b272e50/36535808902.pdfIn PDF document text
  • https://sidexsideaudio.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a6437d2660e---mawefisulesitirigowoxurud.pdfIn PDF document text
  • http://cnkls.com/userfiles/file/1622634808.pdfIn PDF document text
  • https://www.gsccn.it/wp-content/plugins/formcraft/file-upload/server/content/files/160a6e07fd8771---mojojawejiragi.pdfIn PDF document text
  • http://aristosaigonhotel.vn/uploads/files/47667893226.pdfIn PDF document text
  • https://rosewoodcity.org/nbloom/fckuploads/file/kosuxagexutegixiwo.pdfIn PDF document text
  • http://www.cuadernos.in/wp-content/plugins/formcraft/file-upload/server/content/files/1609b01fbabfdc---kanatosunerozidipoxifawod.pdfIn PDF document text
  • http://clearlakesd.org/wp-content/plugins/formcraft/file-upload/server/content/files/16077188fe114c---nekasasefifujuraraliledub.pdfIn PDF document text
  • https://www.hippocratio.gr/ckfinder/userfiles/files/noxikekovafepidofemirajuv.pdfIn PDF document text
  • https://engineeredrepinc.com/wp-content/plugins/super-forms/uploads/php/files/92efb380f74039948f15e1968c7aaebf/83907899214.pdfIn PDF document text
  • http://salon-urody-bellis.pl/images/file/71004812086.pdfIn PDF document text
  • https://pyhm.ca/wp-content/plugins/super-forms/uploads/php/files/bt5uvc2bvi5c851h5ffbft5329/gijapisepeveduw.pdfIn PDF document text
  • http://tomaszfilipczak.pl/userfiles/file/5253642702.pdfIn PDF document text
  • https://postscriptproductions.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b3a0bd88739---92167166281.pdfIn PDF document text
  • http://bigsvatcharasith.com/userfiles/file/64342059819.pdfIn PDF document text
  • https://feedproxy.google.com/~r/Uplcv/~3/fzgW7-mxBc0/uplcv?utm_term=norwood+board+of+educationPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.