Malicious PDF — malware analysis report

Heuristics 5

• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://firesystem.ro/imagini_ws/dudoluzodikisoxibodepup.pdf In PDF document text

  • http://galluccifaibano.com/userfiles/file/1681488242.pdfIn PDF document text
  • https://www.formwork.co.uk/wp-content/plugins/super-forms/uploads/php/files/6e331v8qfnbepbfs28kfufpq5v/41780685123.pdfIn PDF document text
  • http://sakirnoopo.ru/wp-content/plugins/super-forms/uploads/php/files/f4225ebd88b36e1b829a1e5b746b16b2/badonorokitizobi.pdfIn PDF document text
  • http://www.painters-restaurant.com/userfiles/file/68487218882.pdfIn PDF document text
  • http://allergya.news-read.com/upload/files/sosijup.pdfIn PDF document text
  • https://turasmobilya.com/img/editor/image/file/8910717393.pdfIn PDF document text
  • https://arvikabc.com/images/uploadedimages/file/62554051413.pdfIn PDF document text
  • http://imcet.org.tr/kcfinder/upload/files/94839727815.pdfIn PDF document text
  • http://sport-celebrity.com/app/webroot/kcfinder/upload/files/82962653453.pdfIn PDF document text
  • http://halanmilk.com/upload/files/4199328116.pdfIn PDF document text
  • https://www.web2business.pt/wp-content/plugins/formcraft/file-upload/server/content/files/1627744b1a1f07---6120752371.pdfIn PDF document text
  • http://malifer.hu/upload/file/gumufawezinepukon.pdfIn PDF document text
  • http://studiotecnicofrisoli.com/userfiles/files/jujorasekutu.pdfIn PDF document text
  • http://interwork.sk/userfiles/file/dapikefututuwepiwal.pdfIn PDF document text
  • http://aloisiquadri.it/userfiles/files/welagidusujeremezaf.pdfIn PDF document text
  • http://sztarmedia.hu/_user/file/bakojirugupuzigiromifano.pdfIn PDF document text
  • http://digifast.cz/userfiles/paruzefirametunasuduro.pdfIn PDF document text
  • http://plusbateria.com/wp-content/plugins/formcraft/file-upload/server/content/files/16265c9a184491---guwuxumuluvipovopefe.pdfIn PDF document text
  • https://hamayeshniroo.com/shop/file/resubedazopumuzat.pdfIn PDF document text
  • http://www.anieliasfx.com/uploads/textareas/file/47221748522.pdfIn PDF document text
  • https://drproperty.org/userfiles/file/65979730612.pdfIn PDF document text
  • http://quiltingacademy.com/fckeditor/userfiles/file/21681128042.pdfIn PDF document text
  • https://whitelightdesign.com/wp-content/plugins/super-forms/uploads/php/files/81a93595a98d12c347093e6d358778b3/benepafuvapexu.pdfIn PDF document text
  • http://voltgroup.com.ua/assets/kcfinder/upload/files/gesejo.pdfIn PDF document text
  • https://alibaba-cave.com/userfiles/file/miridifubizifogexoso.pdfIn PDF document text
  • http://chs.yuanjen.com/ckfinder/userfiles/files/kumojuwogipenan.pdfIn PDF document text
  • http://oalroax.com/c3?utm_term=spirituality+in+addiction+recovery+worksheetsPDF link annotation
  • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62def61016c55b3779041a82/1658779153455/valeur_des_temps_composs.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62ca49c7423adf1b3660dfd3/1657424328260/xuridino.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62b4ff658e75fa0541a31702/1656029029851/lightning_strike_app.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62daa8251ee6a328b1a9638e/1658497061647/73298722690.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62bc7f85ae9cf344c9725548/1656520581617/tonegarobigi.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62c6770146db3854162af40c/1657173762261/i_spy_books_author.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62c41704cf740c2a5f86655b/1657018116600/32779123806.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62caf48e343ff45a470846a8/1657468047488/mohabbat_me_koi_aashiq_mp3_song_download.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62b84fe7463bd30770cf6c75/1656246248203/on_truth_and_lies_in_a_nonmoral_sense_full_text.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62d9e2ede3ae7a550c3dbb2d/1658446573965/86623089585.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62dfb66e3714301d96b1e0f2/1658828399289/divinity_original_sin_2_complete_crafting_guide.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62da46e9a54138503d411c96/1658472169927/que_son_los_deportes_alternativos.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62bce36b35517b1e592fdc20/1656546156277/fishman_tratado_de_neumologia.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62b2ecd41a2a793eec734e95/1655893204469/vunizofaribogojoka.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62ddbb4497551024c7852c38/1658698565216/rize_full_movie.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62b94bb8697843480b51d0d6/1656310712903/zafiz.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62ec03db3c2b13009a53b422/1659634652728/bruteforce_save_data_ps3_2019.pdfIn PDF document text
  • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62ccf1906fb7e779c027caf2/1657598352991/johari_window_ppt.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62d367695992c6343f556c58/1658021738473/4488919470.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62c4f8c0a8fb3e1b1d7a5118/1657075904954/5719727082.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62d785177b837b6e24620136/1658291480374/69595762695.pdfIn PDF document text
  • https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62e63de59b6a2e482690363d/1659256294020/xekadozixi.pdfIn PDF document text

  +13 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.