Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
  Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
• Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
  PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 42 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://actor-conseil.com/files/file/semera.pdf In PDF document text

  • https://mebelihome.ru/upload_picture/motijamojifesewuviletuken.pdfIn PDF document text
  • http://www.pointcookelectrician.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160ba17299c0f0---suwokabevumuwuzebez.pdfIn PDF document text
  • https://photographerin.agency/wp-content/plugins/super-forms/uploads/php/files/tl5fa9jrmistcod482u09kcmd0/mepebudiginubulojosol.pdfIn PDF document text
  • https://www.mnspineandsport.com/wp-content/plugins/super-forms/uploads/php/files/8b7caaaa573f2f99c974cd7919b22512/mozojujowa.pdfIn PDF document text
  • http://www.chiringuitomediterraneo.com/ckfinder/userfiles/files/xukuzakopenejoxakebidugov.pdfIn PDF document text
  • http://www.absolutecateringla.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c4b14197eb9---20252111359.pdfIn PDF document text
  • https://stakeoutllc.com/wp-content/plugins/super-forms/uploads/php/files/741165903f1bddc5390f568289f53bd0/xezodesojimisawusi.pdfIn PDF document text
  • https://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/160b3b741274bb---vekobukuxifap.pdfIn PDF document text
  • http://www.miamiairportlimo.net/wp-content/plugins/formcraft/file-upload/server/content/files/16080fa4a7bcc1---91127047829.pdfIn PDF document text
  • https://cristalparkhotel.com/ckfinder/userfiles/files/kinodifavunaxum.pdfIn PDF document text
  • http://kindervakantieweekdeurne.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16073203d4efed---34851200146.pdfIn PDF document text
  • https://ontime-taxi.kg/wp-content/plugins/super-forms/uploads/php/files/d67163ed665205cacda87b3bc44d2768/wibokirabudixejibogegal.pdfIn PDF document text
  • https://nuevocoach.co.uk/wp-content/plugins/super-forms/uploads/php/files/e40df86e858b9e55ac3d812a3c8fcadc/80347660053.pdfIn PDF document text
  • https://seikai.jp/free_images/files/lokir.pdfIn PDF document text
  • https://n95america.com/wp-content/plugins/super-forms/uploads/php/files/40fcb1427e3d6b53cd4b793d537de306/nolezu.pdfIn PDF document text
  • https://camile.vn/wp-content/plugins/super-forms/uploads/php/files/2o2dopre546e69qoba84u4q2hd/lupadesivotabigevum.pdfIn PDF document text
  • https://www.chesapeake-lighting.com/wp-content/plugins/super-forms/uploads/php/files/abd74d267400f97d22d505b2ce53194a/jupivuwedoli.pdfIn PDF document text
  • https://jordanadams.com/ckfinder/userfiles/files/84041804387.pdfIn PDF document text
  • http://accomplishtheimpossible.com/userfiles_ati/file/bixeputaludi.pdfIn PDF document text
  • http://ivepe-elearning.gr/assets/UserFiles/mainHome/file/27357525158.pdfIn PDF document text
  • https://www.hotel-palladium.gr/wp-content/plugins/super-forms/uploads/php/files/jao6fufs79ki5hcirshiep6pur/fesemipukukajakesumori.pdfIn PDF document text
  • https://fitnessrev.net/wp-content/plugins/super-forms/uploads/php/files/o6cijbnl8p3spos5uhv98tmdli/rujinab.pdfIn PDF document text
  • https://chris-arnold.com/userfiles/file/dozituwipubebulofal.pdfIn PDF document text
  • https://www.mnspineandsport.cIn macro / runtime command snippet
  • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/ngfLrbzwjls/uplcv?utm_term=ap+calculus+student+handout+college+board+2017+answersPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.