Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://www.pferde-fuer-unsere-kinder.de/wp-content/plugins/formcraft/file-upload/server/content/files/1610fe96daa109---89203995500.pdf In PDF document text

  • http://www.barrettmotors.com.au/templates/admin/js/kcfinder/upload/files/powidufuvokasetebalazox.pdfIn PDF document text
  • https://tfsroanoke.com/home/tfs/public_html/new/ckfinder/userfiles/files/muxererifetokawexuzunan.pdfIn PDF document text
  • https://clubforeducation.com/FCKeditor/userfiles/file/menaf.pdfIn PDF document text
  • https://funeralinnovations.com/copilots/upload/files/siretilufale.pdfIn PDF document text
  • http://nusratali.com/userfiles/files/kejopamizixizinap.pdfIn PDF document text
  • http://cfboxrx.com/js/kcfinder/upload/files/38985256029.pdfIn PDF document text
  • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1616bc13b5a191---kepudurinopafawalig.pdfIn PDF document text
  • http://onlinetalk.jp/app/webroot/img/fckfiles/file/48977315000.pdfIn PDF document text
  • https://multimetrics.com/ckfinder/userfiles/files/luvosodovi.pdfIn PDF document text
  • http://muszempilla.com/files/file/nomikojimugiban.pdfIn PDF document text
  • https://bilalyapidekorasyon.com/userfiles/file/35071159379.pdfIn PDF document text
  • http://xn--9w3b270a7kf.kr/data/editor/file/fupejapeko.pdfIn PDF document text
  • http://china-engine.net/ckfinder/userfiles/files/vetisogebagimas.pdfIn PDF document text
  • https://edftrans.serwiskonsularny.pl/images_user/file/34531049461.pdfIn PDF document text
  • https://sieuthimaycafe.vn/uploads/file/kubijiw.pdfIn PDF document text
  • https://mission4recruitment.com/wp-content/plugins/formcraft/file-upload/server/content/files/161fce6db6e531---kapofipufag.pdfIn PDF document text
  • http://familiegravesen.dk/userfiles/file/53459289006.pdfIn PDF document text
  • http://btfa.tw/upload/files/fubupezodijuwobab.pdfIn PDF document text
  • https://tamtam.com.ua/wp-content/plugins/super-forms/uploads/php/files/7e265766cb67c09e20d034b480b71b80/fazopirogotesevujiba.pdfIn PDF document text
  • https://kalashad.com/userfiles/file/lelugejilotigeb.pdfIn PDF document text
  • http://mariancozma.com/_user/file/sinaj.pdfIn PDF document text
  • https://linardi.ru/files/file/tuzavenatawuvob.pdfIn PDF document text
  • http://www.vljainandco.com/userfiles/files/duligekibegetedefoz.pdfIn PDF document text
  • http://anduong-nhatthanh.com/uploads/news_file/77894260493.pdfIn PDF document text
  • https://brukspec.pl/upload/file/zavis.pdfIn PDF document text
  • http://csc0451.com/userfiles/file/20210916202343_cw9aso.pdfIn PDF document text
  • https://asset-books.com/userfiles/file/86125337590.pdfIn PDF document text
  • https://avphunter.ro/ckfinder/userfiles/files/gavat.pdfIn PDF document text
  • http://www.planetpower-thefilm.com/plugins/kcfinder/upload/files/papelamibewodefadulo.pdfIn PDF document text
  • http://confidenceagricare.com/assets/ckeditor/kcfinder/upload/files/87195515557.pdfIn PDF document text
  • https://fpcofmacon.com/nbloom/fckuploads/file/87081810478.pdfIn PDF document text
  • https://servicenter.ro/ckfinder/userfiles/files/33668013760.pdfIn PDF document text
  • http://obrazyramix.pl/userfiles/file/99278728278.pdfIn PDF document text
  • http://n-production.com/upload/fckeditor/file/bedujuka.pdfIn PDF document text
  • http://lum.windscrm.net/files/file/jiluzibaluxolipijiwuw.pdfIn PDF document text
  • https://telewebmarketing.com/FCKeditor/file/76613766827.pdfIn PDF document text
  • http://advocaciaciervo.com/kcfinder/upload/files/pitupevexixajuzefe.pdfIn PDF document text
  • https://exclusivelimoservice.com/ckfinder/userfiles/files/wonobeb.pdfIn PDF document text
  • http://www.luminicaambiental.com/wp-content/plugins/formcraft/file-upload/server/content/files/161b09f3b23088---77675203607.pdfIn PDF document text
  • http://internet-trade.cz/UserFiles/file/2702052379.pdfIn PDF document text
  • https://kimansion.com/uploads/file/81594594181.pdfIn PDF document text
  • https://envirotechindia.net/admin/userfiles/file/rofikusililusobatewusi.pdfIn PDF document text
  • https://wtmasonry.com/ckfinder/userfiles/files/rixabeximusalimo.pdfIn PDF document text
  • http://eros-arena.com/eros/userfiles/file/woxolijugijagavatarolig.pdfIn PDF document text
  • https://kayakbranson.com/wp-content/plugins/formcraft/file-upload/server/content/files/1619b9baf76ba6---79248678474.pdfIn PDF document text
  • https://yaofangpeixun.com/upload/files/lenimajiremenafexuwo.pdfIn PDF document text
  • http://saluteebenesseresas.it/userfiles/files/76795964331.pdfIn PDF document text
  • https://wirut.co.za/XSRYdR1H?utm_term=bajaj+allianz+life+insurance+claim+form+pdfPDF link annotation
  • https://sharpspringwww.kinsta.cloud/wp-content/plugins/super-forms/uploads/php/files/d0fbbf3faced252aa77dc9f87b08aa4e/tezasobizujatetogofinusox.pdfIn PDF document text

  +8 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.