Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• PDF advertises pirated movie streaming/download medium PDF_PIRACY_STREAMING_LURE
  PDF rendered text advertises free full-movie streaming or download using piracy-brand names or a 'full movie + download/free/watch' intent phrase — recovered after folding the styled Unicode confusables the campaign uses to hide those keywords from plain-text detection. These are disposable SEO-spam carriers that route users to malvertising, fake-player, and scam pages; the PDF itself is inert.
• SEO-redirector lure link (multi-word utm_term) low PDF_SEO_UTM_REDIRECTOR_LINK
  PDF contains a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the search-keyword gateway used by the 'free document download' phishing family. Surfaced as an IOC; on its own this is a low-confidence signal.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://colod.co.za/XSRYdR1H?utm_term=chakravyuh+movie++480p PDF link annotation

  • https://voskovefiguriny.cz/kcfinder/upload/files/50581191360.pdfIn PDF document text
  • http://elmakoleji.k12.tr/public/kcfinder/upload/files/gabazexatonet.pdfIn PDF document text
  • https://stcatherine.ac.ug/wp-content/plugins/formcraft/file-upload/server/content/files/16217ac1a25016---vikogezatodotabejuwevu.pdfIn PDF document text
  • https://airsoft1.ro/files/file/nowovixitag.pdfIn PDF document text
  • http://exdebt.bg/userfiles/file/60982035332.pdfIn PDF document text
  • http://travelweeklearningcenter.com/app/webroot/upload/files/kabugegabitujejatesu.pdfIn PDF document text
  • https://dobski.pl/userfiles/file/gazunakijo.pdfIn PDF document text
  • https://www.koreayokogawa.com/ckfinder/userfiles/files/19815451387.pdfIn PDF document text
  • http://xn--o79av69abka850ab6c.com/upload/file/202203050154036612.pdfIn PDF document text
  • https://www.heainc.com/wp-content/plugins/formcraft/file-upload/server/content/files/161fccfba4d07b---sowopa.pdfIn PDF document text
  • https://cashcruis.ru/wp-content/plugins/super-forms/uploads/php/files/54320cfcf1191818b0c512798f1abc47/momaja.pdfIn PDF document text
  • http://nextgenship.net/upload/file/20220304164637345116.pdfIn PDF document text
  • http://bep-au-cong-nghiep.theonejsc.com/userfiles/file/55068467707.pdfIn PDF document text
  • http://peoplefineart.com/assets/202202/files/20220222105011565557.pdfIn PDF document text
  • https://royaloaktravels.com/UserFiles/file/64361748426.pdfIn PDF document text
  • https://togeltop.net/contents/files/nosesofuxi.pdfIn PDF document text
  • https://nusantarabet4d2.com/contents/files/nujilipajajuvogoxe.pdfIn PDF document text
  • https://corpusbg.com/files/fck/file/zirun.pdfIn PDF document text
  • https://equipelec.fr/ckfinder/userfiles/files/28083107030.pdfIn PDF document text
  • https://kamionosnyelvlecke.hu/userfiles/file/vetanujolozi.pdfIn PDF document text
  • https://himalayanthailand.com/image/upload/File/48061769640.pdfIn PDF document text
  • https://topconta.ro/userfiles/file/wodifab.pdfIn PDF document text
  • http://buafit.bg/Uploads/files/fawogu.pdfIn PDF document text
  • http://ganan10.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/161f85c3b570f5---66770254018.pdfIn PDF document text
  • https://tigaintan.com/contents/files/13135747745.pdfIn PDF document text
  • http://cyuanmei.com/userfiles/file/sodope.pdfIn PDF document text
  • http://demenagements-remond.fr/userfiles/file/20220301195335.pdfIn PDF document text
  • https://www.booster-p.com/wp-content/plugins/formcraft/file-upload/server/content/files/162089b886a764---81759341550.pdfIn PDF document text
  • http://saktigroup.in/uploads/50045206216.pdfIn PDF document text
  • http://www.cpiequipos.com/assets/images/user_files/files/nujimivixuw.pdfIn PDF document text
  • http://aucoindeshalles.fr/menu/file/noliw.pdfIn PDF document text
  • http://www.britocunhaadvocacia.com.br/home/wp-content/plugins/formcraft/file-upload/server/content/files/16217d7315b8dc---guxuvidawikodi.pdfIn PDF document text
  • http://visualpaint.com/wp-content/plugins/formcraft/file-upload/server/content/files/16204c432758da---7754153935.pdfIn PDF document text
  • https://eastoncn.housemember.com/uploads/files/nekajufewoguwimejix.pdfIn PDF document text
  • http://www.fotografoeventimilano.com/wp-content/plugins/formcraft/file-upload/server/content/files/162120e55c313f---noligovelazajijofumamow.pdfIn PDF document text
  • http://internationalnetworksolutions.net/files/dulejizepeva.pdfIn PDF document text
  • https://gresathouse.com/wp-content/plugins/super-forms/uploads/php/files/79c2d9fab838030b0a0e0b8617a1cfa7/moxako.pdfIn PDF document text
  • http://xn--zb0b8a770aowi8xe5tfo88a.com/upload/tmp/file/1645632381.pdfIn PDF document text
  • https://wilsonbarrera.com/inicio/wp-content/plugins/formcraft/file-upload/server/content/files/161fd1641929ff---xilogonesawu.pdfIn PDF document text
  • https://sandpiperpressurecleaning.com/nbloom/fckuploads/file/sugozowidefevejufusefedos.pdfIn PDF document text
  • http://cancunday.com/travela/img/files/desinatoxod.pdfIn PDF document text
  • http://kiavysocina.cz/UserFiles/File/gevowazom.pdfIn PDF document text
  • http://customartdirect.com/kcfinder/upload/files/5603413414.pdfIn PDF document text
  • https://tamm.be/_files/file/90808099061.pdfIn PDF document text
  • https://www.potterycommercials.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/161fecd586e5bc---65418852873.pdfIn PDF document text
  • http://mavelikaradiocese.org/rapha/ckfinder/userfiles/files/17307448745.pdfIn PDF document text
  • https://lcd96.ru/wp-content/plugins/super-forms/uploads/php/files/e4c4d8653d8a4e3b645bec9e819a5c50/matapepuremejapowuf.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text

  +6 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.