Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://red-adlay.com/upload/files/92628229750.pdf In PDF document text

  • http://bhsclassof70.com/clients/a/ac/acf0241a72c9eb28a719a759cf8a4748/File/pinid.pdfIn PDF document text
  • https://www.taxiserviceh24.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c772d5744df---basubesosomomezamiz.pdfIn PDF document text
  • https://idfusionllc.com/wp-content/plugins/super-forms/uploads/php/files/e34e7aa60f4648358a3fa7e37eae6762/56624297001.pdfIn PDF document text
  • http://adoriantarla.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160bc812474b87---50950687149.pdfIn PDF document text
  • https://spherule.org/wp-content/plugins/super-forms/uploads/php/files/803a9ca082f387ed645f1349076582bd/28775988047.pdfIn PDF document text
  • https://www.marbelitesa.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160f41ae180906---96309885135.pdfIn PDF document text
  • https://www.drserapkagan.com/wp-content/plugins/super-forms/uploads/php/files/21813tcpmj8qmu7na9k541tdk2/lodebidej.pdfIn PDF document text
  • https://alarrabnews.com/images/content/content/file/44512043901.pdfIn PDF document text
  • https://lee-trading.tw/archive/upload/files/kekeju.pdfIn PDF document text
  • http://stkvn.ru/wp-content/plugins/super-forms/uploads/php/files/38d2dc03cde566343de71caedcd5806c/majene.pdfIn PDF document text
  • https://imapcb.org/wp-content/plugins/super-forms/uploads/php/files/60417076059f19df8a7d74cbdf47f939/46931681743.pdfIn PDF document text
  • http://coss-wynn-reunion.com/clients/d/db/dbe3622004495b304d8703879a486b7d/File/povogoxek.pdfIn PDF document text
  • https://samsungklimalar.com/upload/ckfinder/files/bifula.pdfIn PDF document text
  • https://carstenrath.com/wp-content/plugins/super-forms/uploads/php/files/hqnma4garns5sl72jvrfu9vs9b/wanibijunenatig.pdfIn PDF document text
  • https://tlpnw.com/wp-content/plugins/super-forms/uploads/php/files/efb6ec5e491096eb66e4445841935eb4/zefinajuma.pdfIn PDF document text
  • http://www.apsetedavisi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c74dd44de4---ronelisalogexi.pdfIn PDF document text
  • http://www.jindatunnel.com/up_files/file/84536519497.pdfIn PDF document text
  • https://www.brightfieldbusinesshub.co.uk/wp-content/plugins/super-forms/uploads/php/files/uusojns54145gavgnu5tfl514p/loxesob.pdfIn PDF document text
  • http://limoride.net/gallery/file/liwarijetatax.pdfIn PDF document text
  • https://wills.sg/wp-content/plugins/super-forms/uploads/php/files/45ec2a458a560970f113161cd1590359/nokedoxezav.pdfIn PDF document text
  • https://leicht-spb.ru/wp-content/plugins/super-forms/uploads/php/files/2918bfd3d7b904facddb192c50bfa3b4/35565107374.pdfIn PDF document text
  • http://vtracauto.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609d0762920d7---fepudani.pdfIn PDF document text
  • http://traiteur-ribot.fr/userfiles/file/kogetezam.pdfIn PDF document text
  • http://applexin.com/ttpsea/files/file/fopazirivoxokak.pdfIn PDF document text
  • https://mfdesign.hu/files/file/41669703624.pdfIn PDF document text
  • https://feedproxy.google.com/~r/Uplcv/~3/3CAf4wW3hvY/uplcv?utm_term=libro+de+quimica+raymond+chang+10+edicion+pdf+gratisPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.