Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Embedded JS stream low PDF_JS
  PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://smidgel.ru/uplcv?utm_term=companies+that+practice+social+responsibility PDF link annotation

  • https://thepetrichortouch.com/wp-content/plugins/super-forms/uploads/php/files/ghtkhe62o4nku1m0smtj6537sb/lifidoku.pdfIn PDF document text
  • https://www.auditek.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1609c9cf216f76---20972670894.pdfIn PDF document text
  • https://www.heracles-hotel.eu/wp-content/plugins/super-forms/uploads/php/files/hppsrmcnbkpn7kfvc78mh7l5lj/pulujovodow.pdfIn PDF document text
  • https://dubaimotorcycletours.com/uploaded_images/files/13920346428.pdfIn PDF document text
  • http://churchliferesources.org/wp-content/plugins/formcraft/file-upload/server/content/files/160acd44142c3f---81449782561.pdfIn PDF document text
  • http://maduraicaterers.com/app/webroot/js/ckfinder/userfiles/files/60834107576.pdfIn PDF document text
  • http://ngpsusa.com/wp-content/plugins/super-forms/uploads/php/files/n1mqgno9j7m9se9ns8s0drgaq1/19667172634.pdfIn PDF document text
  • https://imapcb.org/wp-content/plugins/super-forms/uploads/php/files/vblqnebcg864mcbdup3ho0bmg3/67164173479.pdfIn PDF document text
  • http://securitydirect.it/wp-content/plugins/super-forms/uploads/php/files/f272792eade045a7d7731736faa358e4/86352483709.pdfIn PDF document text
  • http://www.driftime.ee/wp-content/plugins/formcraft/file-upload/server/content/files/160b0374b33a37---niledu.pdfIn PDF document text
  • http://trackeg.com/en/wp-content/plugins/formcraft/file-upload/server/content/files/160b443822bec7---rupanexatenakag.pdfIn PDF document text
  • https://www.emmabowman.com/wp-content/plugins/super-forms/uploads/php/files/647b6f1acd82a2148b8927014723e94d/59069463282.pdfIn PDF document text
  • http://www.hcibatiment.fr/wp-content/plugins/formcraft/file-upload/server/content/files/16094dd65f05a9---80458532228.pdfIn PDF document text
  • http://www.alwaysflorida.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c8f9bfe18be---kebitovokuvife.pdfIn PDF document text
  • https://solarconsulting.org/wp-content/plugins/super-forms/uploads/php/files/fafc9e13a58b58bd2ebf4b2a57d27a8a/xaxumulivakumisukaju.pdfIn PDF document text
  • https://oiweld.com/wp-content/plugins/super-forms/uploads/php/files/a7acd021d03a86ef9c7bd086e943e7f5/wulajopapimesuluzunaji.pdfIn PDF document text
  • https://teenvolunteerdallas.org/wp-content/plugins/super-forms/uploads/php/files/0149d913c2edb2f536f8c3a6b65e27a8/wuvewenekenogirekefuz.pdfIn PDF document text
  • https://gloriouz.in/ckfinder/userfiles/files/zirunibarowusewor.pdfIn PDF document text
  • https://www.audifonosdoshoydos.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a2d6f46e98f---68086926354.pdfIn PDF document text
  • http://www.deadclan.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160d098b0474e4---92688739823.pdfIn PDF document text
  • https://www.simplythebestevents.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1608ef8fe08b20---wejekimuwivazo.pdfIn PDF document text
  • https://hcs1000.org/wp-content/plugins/super-forms/uploads/php/files/e208720bc788616203437d775f6dc493/dasur.pdfIn PDF document text
  • http://klasykarozrywki.pl/public/images/fck/file/xirobupogojuzit.pdfIn PDF document text
  • http://www.hollyskauaicondo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a0a2f3877e---kovanofaduwusowopiru.pdfIn PDF document text
  • http://mahnomenalumni.com/clients/879209/File/46707360181.pdfIn PDF document text
  • https://diedacorporation.net/freesiafiles/file/tegamekibagipa.pdfIn PDF document text
  • https://nationalcardsolutions.com/wp-content/plugins/formcraft/file-upload/server/content/files/160748b2b1c99c---debup.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.