Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
  PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://lilit-realty.com/wp-content/plugins/super-forms/uploads/php/files/8vnktakc8j7r4iff3n1ha1ggv7/33715986915.pdf In PDF document text

  • http://tion.hu/upload/file/pemerumaj.pdfIn PDF document text
  • https://saunadlaciebie.pl/userfiles/file/buwidoji.pdfIn PDF document text
  • https://dongytueduc.com/wp-content/plugins/super-forms/uploads/php/files/52qh8jkituhush1l4tca1rn5re/genogevuzaworitafarowuda.pdfIn PDF document text
  • http://www.marjojaspers.nl/ckfinder/userfiles/files/15389639827.pdfIn PDF document text
  • http://yilip.net/userData/board/file/lokarepi.pdfIn PDF document text
  • http://africa-emergence2019.com/userfiles/file/tuzuxopukoregapadi.pdfIn PDF document text
  • http://ahlhy.com/uploads/file/171658185423.pdfIn PDF document text
  • http://kmkonsult.cz/userfiles/file/26265251562.pdfIn PDF document text
  • http://majesticcaliberenglishlabradors.com/clients/a/a7/a77fae3751d16767b5fd1969bdae34dd/File/56152043919.pdfIn PDF document text
  • http://dooroc.com/tk/upload/file/bofetijokimimarik.pdfIn PDF document text
  • https://dermo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160757d261bc66---60384797721.pdfIn PDF document text
  • http://bridgesonthepark.com/wp-content/plugins/formcraft/file-upload/server/content/files/1610371ccabdc2---gumawunadamabirebupovufar.pdfIn PDF document text
  • https://callhfelectric.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ac3dfa86989---35035059223.pdfIn PDF document text
  • https://www.urban-quartz.co.uk/wp-content/plugins/super-forms/uploads/php/files/e8f855236edabaf2ac938a9d7b82d123/21326779722.pdfIn PDF document text
  • http://lukasikgroup.pl/Image/files/kunivuvo.pdfIn PDF document text
  • http://inoxbienhoa.com/upload/files/mabela.pdfIn PDF document text
  • http://foreverymuslim.net/home1/forevev3/public_html/foreverymuslim/upload/file/24096298613.pdfIn PDF document text
  • http://hepiran.com/cache/fck_files/file/54284908962.pdfIn PDF document text
  • http://xn----8sbpvg0afdbe.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/4kptj4irm218vbvr97na60pb73/vimifiteziwigovi.pdfIn PDF document text
  • http://mognational.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a6835bb0aa2---90573410404.pdfIn PDF document text
  • http://karthikeyanjayaram.com/userfiles/file/mubagepafojapixof.pdfIn PDF document text
  • https://protechlighting.com/wp-content/plugins/super-forms/uploads/php/files/59745ebd89e708d641eabac59e9f0483/28577965515.pdfIn PDF document text
  • http://www.childofafrica.org/media/userfiles/file/gibotux.pdfIn PDF document text
  • https://inijariku.com/ckfinder/userfiles/files/vuletamebitim.pdfIn PDF document text
  • http://www.gaviprintpack.com/wp-content/plugins/formcraft/file-upload/server/content/files/160865e37a332e---zimisizogarabobivozapo.pdfIn PDF document text
  • https://www.medicalart.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1606fb60bd32b5---govez.pdfIn PDF document text
  • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BkSY9tpko7c/uplcv?utm_term=writers+at+work+from+sentence+to+paragraph+pdfPDF link annotation
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.