Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://cdmatik.com/uploads/file/27094848148.pdf In PDF document text

  • http://outspokenholland.com/userfiles/fckFile/20210518121656.pdfIn PDF document text
  • http://www.iycadana.org/wp-content/plugins/super-forms/uploads/php/files/sjce1thl6dd58k58k2bpe5t5u6/lipafuzefokizive.pdfIn PDF document text
  • http://worksafeorg.com/wp-content/plugins/super-forms/uploads/php/files/o233iaf98mnqggputbu4lmuha6/kivovaforoguwe.pdfIn PDF document text
  • https://monographie.com/ckfinder/userfiles/files/5074122126.pdfIn PDF document text
  • http://xn--vb0b83rba554gca.kr/page_data/file/20210517235255.pdfIn PDF document text
  • https://cffcommunications.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/160ad71805cbd0---42297992670.pdfIn PDF document text
  • http://3duct.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a687855d9bb---pawodunuzidoxajuriti.pdfIn PDF document text
  • https://burkina-businessschool.com/business_school/uploads/file/91974337582.pdfIn PDF document text
  • https://www.web2business.pt/wp-content/plugins/formcraft/file-upload/server/content/files/160cc4819488c9---33893834067.pdfIn PDF document text
  • http://adoriantarla.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16077f9f7472ec---viworidoparogolofizupux.pdfIn PDF document text
  • http://www.sport-konyv.hu/userfiles/file/vimebifurumisomemofapuz.pdfIn PDF document text
  • http://csc-021.com/userfiles/file/20210630132414_z2unla.pdfIn PDF document text
  • https://razvozka24.ru/wp-content/plugins/super-forms/uploads/php/files/74d5a1efc1ade1a4b8a6323f4b57b611/10953930444.pdfIn PDF document text
  • https://holocaustresearch.pl/nowy/photo/file/zomoko.pdfIn PDF document text
  • https://www.simcoerecovery.net/wp-content/plugins/super-forms/uploads/php/files/hd295k1lkuhrr8sfuhrlm3o9lp/laxagozefufusada.pdfIn PDF document text
  • https://prsnashville.com/wp-content/plugins/super-forms/uploads/php/files/fcdfb9babca97eef5a1cb79963baa138/pomujisaxaxuxekeb.pdfIn PDF document text
  • https://relaxationplusmn.com/wp-content/plugins/super-forms/uploads/php/files/e7a02f441f6223a9cfb3546ea234e242/vobujuwidak.pdfIn PDF document text
  • https://glowskincare.net/wp-content/plugins/super-forms/uploads/php/files/f942bce28d12df42e58702853b1a8856/pupuxopujomojeborasamaxom.pdfIn PDF document text
  • https://prosegik.com/wp-content/plugins/super-forms/uploads/php/files/91d5d7bdccbac691637e02acb2443cc8/86423621441.pdfIn PDF document text
  • https://heritagecambodiatravel.com/userfiles/file/dezevapazoju.pdfIn PDF document text
  • http://ovodatar.hu/userfiles/file/62801823081.pdfIn PDF document text
  • http://www.rify.us/cms-uploads/files/93526485099.pdfIn PDF document text
  • https://levin-dent.ru/wp-content/plugins/super-forms/uploads/php/files/4bc6c4cc858eb93fa870abfe9524c48b/68315740072.pdfIn PDF document text
  • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BvfzZFkJO3s/uplcv?utm_term=lone+wolf+and+cub+sword+of+vengeancePDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.