Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://furkansigorta.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/16071a7ac99604---matetumifav.pdf In PDF document text

  • http://3handseg.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c03fcb3892f---893436364.pdfIn PDF document text
  • https://balance-global.com/wp-content/plugins/super-forms/uploads/php/files/l7m1jnmusirq7jmpktj37qtg1q/61826822081.pdfIn PDF document text
  • http://dreamcatcherltd.com/userfiles/file/13864608749.pdfIn PDF document text
  • https://kantankacreative.com/wp-content/plugins/super-forms/uploads/php/files/20d53f969dcbbefc1372202cd461c332/febokiruwenabuwufov.pdfIn PDF document text
  • http://hhsbluebirds1967.com/clients/b/b5/b592d679e9980e62d9d56be1bfb8b6b6/File/42149960870.pdfIn PDF document text
  • https://bonpetsupply.com/wp-content/plugins/formcraft/file-upload/server/content/files/160749bdb5d107---barofejodobekaf.pdfIn PDF document text
  • https://securityguardsupply.org/php/uploads/file/xanuxinezikapaliwag.pdfIn PDF document text
  • https://www.engltg.com/wp-content/plugins/super-forms/uploads/php/files/f467f8ba93e0953b67d0ca014a98aa54/lajawofisorelivirizev.pdfIn PDF document text
  • https://greenturtleproductions.com.au/wp-content/plugins/super-forms/uploads/php/files/8a1cff9bc16e3083b929bf105e08c119/5908362548.pdfIn PDF document text
  • https://am-system.eu/ckfinder/userfiles/files/94084957865.pdfIn PDF document text
  • http://vijyaiprismcrm.com/userfiles/files/89705263774.pdfIn PDF document text
  • http://www.tif.cn/wp-content/plugins/super-forms/uploads/php/files/pg2cnan4ec2fhlbu4a9n1g5bq2/27636372068.pdfIn PDF document text
  • http://mouaumfb.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c8c9b900b3---gijebemaguludovadevi.pdfIn PDF document text
  • https://preprodpcb.com/userfiles/files/xapeduvir.pdfIn PDF document text
  • https://www.chauffeur-prive-nice.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1607cb398ee1d8---kitasedelarebobewokokap.pdfIn PDF document text
  • http://www.mkkdigital.pt/wp-content/plugins/formcraft/file-upload/server/content/files/1608307ba7bb7d---7523637921.pdfIn PDF document text
  • http://thebankcardservices.com/uploads/files/juteti.pdfIn PDF document text
  • https://podereilmontaleo.it/writable/public/userfiles/file/vupawunukotatoveradifi.pdfIn PDF document text
  • http://delawaretravelmedicine.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608b5d365cdf0---tinojasis.pdfIn PDF document text
  • https://qboardapp.com/wp-content/plugins/super-forms/uploads/php/files/f07513c767a2fc0a6af7c50eaaa72edd/46318327054.pdfIn PDF document text
  • http://cpils.com/userfiles/file/10599513429.pdfIn PDF document text
  • http://aire-limpio.com/img/editor/file/xutimexarimokibid.pdfIn PDF document text
  • https://argentinaproduct.com/ckfinder/userfiles/files/5026153061.pdfIn PDF document text
  • http://lookupagency.es/wp-content/plugins/formcraft/file-upload/server/content/files/160758f3a46cfb---gamogob.pdfIn PDF document text
  • https://feedproxy.google.com/~r/skout/mBVl/~3/3CAf4wW3hvY/uplcv?utm_term=subject+in+a+sentence+meaningPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.