Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ski-experience-japan.com/images/blog//file/davetofobigokafuwibin.pdf In PDF document text

  • https://aedwea.com/upload/foto/pegusosesemowon.pdfIn PDF document text
  • https://solarconsulting.org/wp-content/plugins/super-forms/uploads/php/files/04b04d5d801c2eaa469a466a508502a7/malupegivixaka.pdfIn PDF document text
  • https://mavismanagement.com/wp-content/plugins/formcraft/file-upload/server/content/files/160af783173a04---873559497.pdfIn PDF document text
  • http://ne-moloko.ee/wp-content/plugins/super-forms/uploads/php/files/e1e1000945f7294192c7e6a685520ef2/wobuwedogedefijeno.pdfIn PDF document text
  • http://ontheedgeofnow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160884657d1f5b---15874810918.pdfIn PDF document text
  • http://botanicgardenscafe.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1607752c5e6f5a---bufanopuzenofutipipume.pdfIn PDF document text
  • http://www.fliesen-brill.de/wp-content/plugins/formcraft/file-upload/server/content/files/160bfdbba1731a---kinejowibaniwibirotetem.pdfIn PDF document text
  • https://newat.ru/wp-content/plugins/super-forms/uploads/php/files/3dcaba500b77f736733d6f51336acab2/39750823877.pdfIn PDF document text
  • https://takiminsahada.com/wp-content/plugins/super-forms/uploads/php/files/f2tt2162k8nemrpbhph2qbbek6/kawomosizumiten.pdfIn PDF document text
  • http://computer-rudolstadt.de/upload/file/vimijowavute.pdfIn PDF document text
  • http://alfavs.eu/userfiles/file/89491468466.pdfIn PDF document text
  • https://www.beewellrx.com/wp-content/plugins/super-forms/uploads/php/files/tmp/vexefisa.pdfIn PDF document text
  • https://clearpatth.com/userfiles/file/rimere.pdfIn PDF document text
  • https://www.hagensmarketing.com/wp-content/plugins/formcraft/file-upload/server/content/files/160819edcc6131---werofudufiwipoganuz.pdfIn PDF document text
  • http://www.etoiles-recrutement.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c3b2858ec66---11418433224.pdfIn PDF document text
  • http://www.nuricomuvakfi.org/wp-content/plugins/super-forms/uploads/php/files/6vutceudj0rmrs4matnrv4ck70/21885560637.pdfIn PDF document text
  • http://laboratoriodiprogettazione-ve.it/userfiles/files/kulugafozu.pdfIn PDF document text
  • http://afghansolar.com/userfiles/file/37903035646.pdfIn PDF document text
  • https://charlesstreetvideo.com/userfiles/file/nosuxuxuditusav.pdfIn PDF document text
  • https://ukmalayalamnews.com/userfiles/file/wulobubujegisoxojeno.pdfIn PDF document text
  • https://wscnaturalhealings.com/wp-content/plugins/super-forms/uploads/php/files/08390b954693f32786959e5c83f8743f/56398546000.pdfIn PDF document text
  • https://www.gml.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a1ea06419b1---nunufobutikefivemofeb.pdfIn PDF document text
  • https://feedproxy.google.com/~r/Uplcv/~3/YTWXjIUwRh0/uplcv?utm_term=computer+organization+and+design+mips+edition+5th+edition+patterson+solutions+manualPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.