Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://www.nanodrywash.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607701162fa4a---36335889620.pdf In PDF document text

  • http://www.skupp.pl/wp-content/plugins/formcraft/file-upload/server/content/files/160a0c511c5549---63673437067.pdfIn PDF document text
  • http://arablift.net/userfiles/file/67961184022.pdfIn PDF document text
  • https://www.tifdip.com/wp-content/plugins/formcraft/file-upload/server/content/files/160afe6cf4a337---91936280735.pdfIn PDF document text
  • https://www.dekleinewerf.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1607333e492e01---61721883581.pdfIn PDF document text
  • http://cablexconsulting.com/Upload/file/9190813844.pdfIn PDF document text
  • http://alvasari.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b9b1d8080b---revajomapinorebazo.pdfIn PDF document text
  • http://www.kissdocs.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1608075cb1778e---57857237218.pdfIn PDF document text
  • https://controlcert.se/wp-content/plugins/formcraft/file-upload/server/content/files/160bbe4b84039c---39842855850.pdfIn PDF document text
  • http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/p84l5hbirqism7u0vslmri9o27/wibus.pdfIn PDF document text
  • https://www.fecomerciomg.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/160cb296ec5913---72815487285.pdfIn PDF document text
  • https://3dreamvr.com/wp-content/plugins/super-forms/uploads/php/files/cbaaa305be8cdbfdf2064fccf38c7c0c/suvugotokaxikija.pdfIn PDF document text
  • https://fjordancv.info/wp-content/plugins/super-forms/uploads/php/files/b179f93fcff11a0fdb4a26009e61fa2b/sixajogatesetanukoriz.pdfIn PDF document text
  • http://www.canadiantreasurer.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d6c54f79a88---kigefufowiwagolukoba.pdfIn PDF document text
  • https://englewoodgrassfarm.com/wp-content/plugins/super-forms/uploads/php/files/db1f9680591383fcd79018730ca7ffd1/gulozu.pdfIn PDF document text
  • https://www.servicioscalibrados.com/wp-content/plugins/super-forms/uploads/php/files/8b0503ad29609919ed2def3e1b54fdcc/gupijaguliloru.pdfIn PDF document text
  • https://semut73.com/contents//files/78095319978.pdfIn PDF document text
  • https://atx-stroy.ru/wp-content/plugins/super-forms/uploads/php/files/22dc8b385dd051a815b06b2df800b75b/defirajub.pdfIn PDF document text
  • https://conexkarvan.com/cache/fck_files/file/pilinakugozar.pdfIn PDF document text
  • http://gtshotel.it/images/file/42913842426.pdfIn PDF document text
  • http://parkwestresidences.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a08d3e97459---88400335409.pdfIn PDF document text
  • https://kassa-evotor.ru/wp-content/plugins/super-forms/uploads/php/files/7aaa02dcvvfmck6096vrgpebod/59340919560.pdfIn PDF document text
  • http://topopentertainment.com/wp-content/plugins/formcraft/file-upload/server/content/files/160adb753e5039---12084032505.pdfIn PDF document text
  • http://mdsalon.ru/img/lib/file/mozolewuz.pdfIn PDF document text
  • http://www.loicadesacavem.pt/wp-content/plugins/formcraft/file-upload/server/content/files/1607fd1945392d---fuwivokixilupumewo.pdfIn PDF document text
  • http://www.alfainstal.pl/wp-content/plugins/formcraft/file-upload/server/content/files/160985a8c3f2b4---70028836737.pdfIn PDF document text
  • https://feedproxy.google.com/~r/Uplcv/~3/cv9VXjIrmdE/uplcv?utm_term=thank+you+message+for+principal+from+teacherPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.